CVE-2026-10051: Infoleak
Description
> FINDING — MEDIUM (HTTP/1.1 keep-alive connections with trailers) > HttpConnection.trailers Cross-Request Leakage (Never Reset Between Requests) > > Location: > jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/ > HttpConnection.java:107, 1157-1161, 1170 > > Detail: > trailers (line 107) is a connection-scoped HttpFields.Mutable field. > parsedTrailer() (line 1157) populates it when request N carries HTTP trailers. > messageComplete() (line 1170) checks "if (trailers != null)" — evaluates true > from request N's data — and stamps it onto request N+1. > > Grep confirms: ZERO occurrences of "trailers = null" in entire HttpConnection.java. > > Scenario: > Request N: POST /upload (trailers: X-Checksum: abc123) > Request N+1: GET /data (no trailers) > app: request.getTrailers() on N+1 → returns {X-Checksum: abc123} ← STALE > > Application logic branching on getTrailers() != null produces incorrect behavior. > Not cross-connection (same keep-alive connection only). > > More dangerous scenario: TOCTOU — trailer passes check, target swapped before use.
Workarounds Do not rely on HTTP request trailers for security-sensitive logic, or disable persistent connections by closing the connection after each HTTP/1.1 request.
Other sources
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the union of trailers of the first request and the current request.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.eclipse.jetty:jetty-serverto a version that resolves this vulnerability.Fixed in 12.1.10 - Upgrade
Upgrade
maven/org.eclipse.jetty:jetty-serverto a version that resolves this vulnerability.Fixed in 12.0.36 - Configuration
Disable HTTP/1.1 persistent connections by closing the connection after each HTTP/1.1 request so trailers cannot leak across requests on the same keep-alive connection.
Eclipse Jetty (HTTP/1.1 keep-alive) disable persistent connections (close connection after each HTTP/1.1 request) = enabled - Configuration
Do not rely on HTTP request trailers for security-sensitive logic (e.g., avoid branching on getTrailers() contents such as getTrailers() != null for authorization or decisioning).
Application logic use of HTTP request trailers for security-sensitive logic (request.getTrailers()) = do not rely on trailers
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10051?
The severity of CVE-2026-10051 is medium, with a CVSS score of 6.9.
What type of vulnerability is CVE-2026-10051?
CVE-2026-10051 is an information leakage vulnerability affecting Eclipse Jetty.
How do I fix CVE-2026-10051?
To fix CVE-2026-10051, update Eclipse Jetty to the latest version that addresses this issue.
Which software is affected by CVE-2026-10051?
CVE-2026-10051 affects the Eclipse Jetty server.
What is the potential impact of CVE-2026-10051?
The potential impact of CVE-2026-10051 is the unauthorized disclosure of HTTP request trailers between connections.