8.7

CVE-2026-12611: eclipse foundation eclipse jetty Uncontrolled Resource Consumption

CVSS: 8.7v4.0HighDeferred
AliasesUBUNTU-CVE-2026-12611DEBIAN-CVE-2026-12611openSUSE-SU-2026:11804-1
Published 08-09-2026Last modified 09-09-2026
Open JSON

Vulnerability summary

CVE-2026-12611 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in eclipse foundation eclipse jetty. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.7% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
0.25%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 08-09-2026
    PublishedVulnerability first disclosed.
  2. 09-09-2026
    Last modifiedVulnerability information updated.

Description

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client. The race condition "resets" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

16%

Versus all other CVEs

30-day change

0.00 pp

From 0.25% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • jetty12All versions (No fix recorded)
  • jetty9All versions (No fix recorded)
Ubuntu2 products
  • jetty12All versions (No fix recorded)
  • jetty9All versions (No fix recorded)
Eclipse foundation1 product
  • eclipse jetty≥ 12.1.0, ≤ 12.1.10 | ≥ 12.0.0, ≤ 12.0.37 | ≥ 11.00, ≤ 11.0.31 | ≥ 10.0.0, ≤ 10.0.31 | ≥ 9.4.36, ≤ 9.4.63
Opensuse1 product
  • jetty-minimal&distro=openSUSE Tumbleweed< 9.4.58-6.1

4 vendors · 6 products

References

5 links