High severity · published Sep 8, 2026
CVE-2026-12611
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to…
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive.
This is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client.
The race condition "resets" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EJ
Eclipse Jetty · Eclipse Foundation
12.1.0 through 12.1.10; 12.0.0 through 12.0.37; 11.00 through 11.0.31; 10.0.0 through 10.0.31; 9.4.36 through 9.4.63 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12611
github.com
https://github.com/jetty/jetty.project/security/advisories/GHSA-gpg9-4257-cfm3
More from Eclipse Jetty
9.1
CVE-2026-10050
Digest authentication lossy encoding
9.1
CVE-2026-2332
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
8.7
CVE-2026-19204
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the…
8.3
CVE-2026-19203
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially…
8.2
CVE-2026-77711
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required)
