GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-F4V5-65JJ-PCR2

Vulnerability from github – Published: 2026-07-22 22:56 – Updated: 2026-07-22 22:56
VLAI
Summary
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
Details

Description

FINDING — MEDIUM (HTTP/1.1 keep-alive connections with trailers) HttpConnection._trailers Cross-Request Leakage (Never Reset Between Requests)

Location: jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/ HttpConnection.java:107, 1157-1161, 1170

Detail: _trailers (line 107) is a connection-scoped HttpFields.Mutable field. parsedTrailer() (line 1157) populates it when request N carries HTTP trailers. messageComplete() (line 1170) checks "if (_trailers != null)" — evaluates true from request N's data — and stamps it onto request N+1.

Grep confirms: ZERO occurrences of "_trailers = null" in entire HttpConnection.java.

Scenario: Request N: POST /upload (trailers: X-Checksum: abc123) Request N+1: GET /data (no trailers) app: request.getTrailers() on N+1 → returns {X-Checksum: abc123} ← STALE

Application logic branching on getTrailers() != null produces incorrect behavior. Not cross-connection (same keep-alive connection only).

More dangerous scenario: TOCTOU — trailer passes check, target swapped before use.

Workarounds

Do not rely on HTTP request trailers for security-sensitive logic, or disable persistent connections by closing the connection after each HTTP/1.1 request.

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 12.0.35"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jetty:jetty-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0"
            },
            {
              "fixed": "12.0.36"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 12.1.9"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jetty:jetty-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.1.0"
            },
            {
              "fixed": "12.1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-10051"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-22T22:56:05Z",
    "nvd_published_at": "2026-07-14T09:16:39Z",
    "severity": "MODERATE"
  },
  "details": "### Description\n\n\u003e FINDING \u2014 MEDIUM (HTTP/1.1 keep-alive connections with trailers)\n\u003e HttpConnection._trailers Cross-Request Leakage (Never Reset Between Requests)\n\u003e \n\u003e Location:\n\u003e   jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/\n\u003e   HttpConnection.java:107, 1157-1161, 1170\n\u003e \n\u003e Detail:\n\u003e   _trailers (line 107) is a connection-scoped HttpFields.Mutable field.\n\u003e   parsedTrailer() (line 1157) populates it when request N carries HTTP trailers.\n\u003e   messageComplete() (line 1170) checks \"if (_trailers != null)\" \u2014 evaluates true\n\u003e   from request N\u0027s data \u2014 and stamps it onto request N+1.\n\u003e \n\u003e   Grep confirms: ZERO occurrences of \"_trailers = null\" in entire HttpConnection.java.\n\u003e \n\u003e   Scenario:\n\u003e     Request N:   POST /upload (trailers: X-Checksum: abc123)\n\u003e     Request N+1: GET  /data   (no trailers)\n\u003e     app: request.getTrailers() on N+1 \u2192 returns {X-Checksum: abc123} \u2190 STALE\n\u003e \n\u003e   Application logic branching on getTrailers() != null produces incorrect behavior.\n\u003e   Not cross-connection (same keep-alive connection only).\n\u003e \n\u003e   More dangerous scenario: TOCTOU \u2014 trailer passes check, target swapped before use.\n\n### Workarounds\nDo not rely on HTTP request trailers for security-sensitive logic, or disable persistent connections by closing the connection after each HTTP/1.1 request.",
  "id": "GHSA-f4v5-65jj-pcr2",
  "modified": "2026-07-22T22:56:05Z",
  "published": "2026-07-22T22:56:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-f4v5-65jj-pcr2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10051"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jetty/jetty.project/pull/15162"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jetty/jetty.project/pull/15163"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jetty/jetty.project/commit/72206b3ea623cf7ed8729b47a83ee628ff10e8eb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jetty/jetty.project/commit/dc27e8d3ab743fe27935ea2d8c41756eb6c5bae9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jetty/jetty.project"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.