CVE-2026-10051: 
Jetty vulnerability analysis and mitigation

CVE-2026-10051 is an HTTP/1.1 trailer leakage vulnerability in Eclipse Jetty that causes the server to retain and expose HTTP request trailers across persistent connections. When a first request with trailers is received, subsequent requests on the same connection incorrectly inherit those trailers — either fully (if the new request has none) or as a union (if the new request also has trailers). This constitutes a memory disclosure issue classified under CWE-200. Affected versions are Eclipse Jetty 12.0.0 through 12.0.35 and 12.1.0 through 12.1.9. The vulnerability was published on July 14, 2026, and carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (Eclipse CVE Assignment).

The root cause is improper state management in Eclipse Jetty's HTTP/1.1 connection handler, which fails to clear trailer metadata between requests on the same persistent (keep-alive) connection (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). When a client sends an HTTP/1.1 chunked request with trailing headers, Jetty stores these trailers in connection-level state rather than request-level state, causing them to persist and bleed into subsequent requests. An attacker can exploit this by establishing a persistent HTTP/1.1 connection, sending an initial request with crafted trailers, and then observing that subsequent requests — including those from other users sharing the connection — report the leaked trailers. No authentication or special privileges are required, and the attack is network-accessible with low complexity (Eclipse CVE Assignment).

Successful exploitation allows an unauthenticated remote attacker to read HTTP request headers and trailers from prior requests on the same persistent connection, constituting a confidentiality breach. Sensitive data carried in HTTP trailers — such as authentication tokens, session identifiers, or application-specific metadata — could be exposed to subsequent requesters on the same connection. Integrity and availability are not directly impacted, but the information disclosure could facilitate further attacks such as session hijacking or privilege escalation (Eclipse CVE Assignment).

1. Establish a persistent HTTP/1.1 connection: Connect to a vulnerable Eclipse Jetty server (versions 12.0.0–12.0.35 or 12.1.0–12.1.9) using an HTTP client that supports keep-alive connections and chunked transfer encoding.
2. Send an initial request with trailers: Issue an HTTP/1.1 chunked POST or GET request that includes trailing headers (e.g., Trailer: X-Sensitive-Header in the request headers, followed by the trailer value after the chunked body).
3. Send subsequent requests on the same connection: Without closing the connection, send additional HTTP/1.1 requests that do not include trailers.
4. Observe trailer leakage: Inspect the server-side processing or any reflected response data — the server will incorrectly associate the trailers from the first request with subsequent requests, potentially exposing sensitive header values to application logic or other users sharing the connection (Eclipse CVE Assignment).

• Network: Persistent HTTP/1.1 connections (keep-alive) to Jetty servers with chunked transfer-encoded requests containing Trailer: headers; multiple sequential requests over a single TCP connection where early requests include trailer headers.
• Logs: Jetty access logs showing repeated requests from the same source IP over a single connection, particularly with chunked encoding and trailer-related headers; application logs reflecting unexpected header values in requests that should not contain them.
• Process/Application: Application-level anomalies where request processing receives unexpected trailer fields not sent by the current client, potentially causing authorization or routing errors.

Eclipse Foundation has released patched versions: Eclipse Jetty 12.0.36 (for the 12.0.x branch) and Eclipse Jetty 12.1.10 (for the 12.1.x branch). Upgrading to these versions is the recommended remediation (Eclipse CVE Assignment). As a temporary workaround if immediate patching is not feasible, consider disabling HTTP/1.1 trailer support at the application or reverse proxy layer if trailers are not required by the application, or implement connection limits to reduce the window for cross-request leakage.