THREAT OPS › Threat News › [NVD] CVE-2026-1605 (HIGH 7.5) — In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.
This happens because the JDK Inflater is allocated
[NVD] CVE-2026-1605 (HIGH 7.5) — In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated
CVE-2026-1605 CVSS: 7.5 HIGH Published: 2026-03-05T10:15:56.890
In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.
This happens because the JDK Inflater is allocated for decompressing the request, but it is not released b
Indicators of compromise
- CVE-2026-1605cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-1605