CVE-2026-10051: Eclipse Jetty Information Disclosure Flaw

CVE-2026-10051 Overview

CVE-2026-10051 affects Eclipse Jetty, a widely deployed Java HTTP server and servlet container. The flaw causes the server to retain HTTP/1.1 trailers from the first request on a persistent connection and expose them in subsequent requests on the same connection. Requests without trailers report the first request's trailers, while requests with trailers report the union of both sets. The issue maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Cross-request trailer leakage on shared HTTP/1.1 connections can expose sensitive header values from one client's request to another, breaking request isolation on proxies, load balancers, and shared upstream connections.

Affected Products

Eclipse Jetty (see vendor advisory for affected versions)
Applications and gateways embedding the Jetty HTTP/1.1 server
Reverse proxies and API gateways built on Jetty that share upstream connections

Discovery Timeline

2026-07-14 - CVE-2026-10051 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-10051

Vulnerability Analysis

HTTP/1.1 trailers are headers sent after the message body in a chunked transfer, commonly used to convey checksums, signatures, or authorization metadata computed during streaming. Jetty parses these trailers into a request-scoped structure but fails to clear that structure when the underlying TCP connection is reused for the next HTTP/1.1 request. The next request served on that connection then reads stale trailer values as if they belonged to its own message.

Because Jetty is frequently deployed behind or in front of shared HTTP/1.1 connection pools, one client's trailers can surface in unrelated downstream processing. Applications that treat trailers as authenticated request metadata, such as signed content hashes or per-request tokens, may make incorrect trust decisions. The vulnerability requires no authentication and is exploitable over the network against any endpoint that accepts HTTP/1.1 with trailers.

Root Cause

The root cause is missing state reset between requests on a persistent HTTP/1.1 connection. Jetty's request lifecycle does not clear the trailer collection when preparing the parser and request object for the next message. Subsequent requests inherit the previous request's trailer map, and any newly parsed trailers are merged rather than replacing the prior state.

Attack Vector

An attacker with the ability to send an HTTP/1.1 request containing trailers to a vulnerable Jetty server can influence the trailers observed by later requests on the same connection. In shared connection pool topologies, the follow-on request may originate from a different tenant or user. The attack requires no privileges and no user interaction. Exploitation is opportunistic when connection sharing is present between distinct principals, and deterministic when the attacker controls both requests.

No verified public exploit code is available. See the Eclipse CVE Assignment Work Item for technical details.

Detection Methods for CVE-2026-10051

Indicators of Compromise

Application logs showing trailer header values on requests that did not include chunked transfer encoding or trailer declarations.
Repeated identical trailer values across unrelated requests served by the same Jetty worker or connection.
Signature or checksum validation failures where the trailer value belongs to a prior request body.

Detection Strategies

Inventory Jetty deployments using build manifests, container image scans, and runtime process enumeration to identify vulnerable versions.
Instrument request handlers to log the presence of trailers along with the Transfer-Encoding and Trailer request headers, then alert on mismatches.
Replay controlled HTTP/1.1 pipelined test traffic in staging with and without trailers to confirm whether trailer state persists across requests.

Monitoring Recommendations

Monitor upstream and downstream proxies for HTTP/1.1 connection reuse patterns that cross tenant or user boundaries.
Track EPSS movement for CVE-2026-10051, currently 0.253% at the 16.786 percentile as of 2026-07-20, and re-evaluate exposure when weaponization signals appear.
Alert on anomalous trailer content types reaching authentication, authorization, or signature-verification code paths.

How to Mitigate CVE-2026-10051

Immediate Actions Required

Upgrade Jetty to the fixed version listed in the Eclipse CVE Assignment Work Item.
Audit application code that reads request trailers and treat trailer values as untrusted until the patch is applied.
Disable HTTP/1.1 keep-alive on affected endpoints where trailers are not required by the protocol contract.

Patch Information

Eclipse has tracked remediation through the vendor advisory. Apply the vendor-supplied Jetty release that clears trailer state between requests on a persistent connection. Redeploy applications, container images, and embedded distributions that ship Jetty as a dependency, and verify the runtime version after deployment.

Workarounds

Terminate HTTP/1.1 at a front-end proxy that does not exhibit trailer leakage, and forward requests over a protocol path that discards trailers.
Configure Jetty to reject requests containing trailers when the application has no legitimate use for them.
Force Connection: close on responses to prevent connection reuse until the patched version is deployed.

bash

# Example: reject requests advertising trailers at a front proxy (nginx)
map $http_te $block_trailers {
    default        0;
    "~*trailers"   1;
}

server {
    if ($block_trailers) { return 400; }
    proxy_http_version 1.1;
    proxy_set_header Connection "close";
    proxy_pass http://jetty_upstream;
}