CVE-2026-12611: Jetty HTTP/2 Race Condition Vulnerability

CVE-2026-12611 Overview

CVE-2026-12611 is a denial-of-service vulnerability in the Eclipse Jetty HTTP/2 server implementation. A remote client can send crafted HTTP/2 requests that trigger blocking writes which are never unblocked. Over time, worker threads accumulate in a blocked state until the server becomes fully unresponsive.

The root defect is a race condition in the handling of RST_STREAM and GOAWAY frames. This race resets the HTTP2Flusher.terminated field back to null after termination, allowing new entries to be enqueued that will never be processed. The GitHub Security Advisory GHSA-gpg9-4257-cfm3 covers the technical background.

Critical Impact
Unauthenticated remote attackers can exhaust all server threads over HTTP/2, halting request processing on affected Jetty deployments.

Affected Products

Eclipse Jetty (versions listed in GHSA-gpg9-4257-cfm3)
Jetty HTTP/2 server module (jetty-http2-server)
Applications and appliances embedding vulnerable Jetty releases

Discovery Timeline

2026-09-08 - CVE-2026-12611 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-12611

Vulnerability Analysis

The flaw resides in Jetty's HTTP/2 write pipeline, specifically in the HTTP2Flusher component that serializes frame writes onto a connection. When a client sends RST_STREAM or GOAWAY frames concurrently with active streams, a race window allows the flusher's terminated marker to be cleared after termination has already occurred.

Once terminated is null again, subsequent enqueue operations succeed but the flusher no longer processes them. Requests that were blocked waiting on a write completion callback stay blocked indefinitely. Because Jetty's request handling model dispatches work onto a bounded thread pool, each stuck request consumes a thread. As new HTTP/2 requests arrive, the pool saturates and the server stops responding to any client.

The issue is categorized as an uncontrolled resource consumption weakness [CWE-400]. No authentication or user interaction is required. An attacker only needs network reachability to the HTTP/2 listener.

Root Cause

A race condition between concurrent HTTP/2 control frame processing paths overwrites the HTTP2Flusher.terminated state. The termination marker is set to a non-null sentinel to indicate the flusher must not accept further work, but a competing code path resets it to null. This violates the assumed ordering that termination is a one-way transition.

Attack Vector

Exploitation is fully remote over HTTP/2. A client establishes an HTTP/2 connection, opens streams that trigger blocking writes on the server, and interleaves RST_STREAM and GOAWAY frames to hit the race window. Repeating this pattern across multiple streams and connections progressively exhausts the Jetty worker thread pool until the server is unresponsive.

No verified proof-of-concept code is published. Refer to the Jetty security advisory for reproduction details and vendor guidance.

Detection Methods for CVE-2026-12611

Indicators of Compromise

Sustained growth in Jetty worker thread count with threads parked in write-completion waits
HTTP/2 connections that send high volumes of RST_STREAM or GOAWAY frames shortly after opening streams
Server stops accepting new requests while the process remains running and TCP listener is open
Thread dumps showing many threads blocked inside HTTP2Flusher or associated write callbacks

Detection Strategies

Instrument the JVM to alert when Jetty's queued thread pool utilization exceeds a sustained threshold
Parse access logs for clients producing abnormal RST_STREAM/GOAWAY ratios per connection
Correlate application health-check failures with HTTP/2 traffic spikes from single source IPs

Monitoring Recommendations

Export Jetty thread pool and HTTP/2 session metrics to your observability stack
Track per-client HTTP/2 frame type distributions at the load balancer or reverse proxy
Alert on process-level unresponsiveness where the JVM is alive but not serving requests

How to Mitigate CVE-2026-12611

Immediate Actions Required

Upgrade Jetty to the fixed release identified in GHSA-gpg9-4257-cfm3
Inventory all applications and appliances embedding Jetty and prioritize internet-exposed HTTP/2 listeners
Enforce rate limits on HTTP/2 RST_STREAM and GOAWAY frames at upstream proxies

Patch Information

Eclipse Jetty maintainers have published a fix through the project's security advisory process. Consult GHSA-gpg9-4257-cfm3 for the exact fixed versions across the 9.x, 10.x, 11.x, and 12.x branches and update jetty-http2-server and related artifacts accordingly.

Workarounds

Terminate HTTP/2 at a reverse proxy that enforces strict frame-rate and connection limits
Disable HTTP/2 on Jetty and serve traffic over HTTP/1.1 where feasible until patching completes
Restrict inbound access to the Jetty listener using network ACLs while remediation is in progress

bash

# Example: disable HTTP/2 in a Jetty deployment by removing the http2 module
java -jar $JETTY_HOME/start.jar --remove-module=http2
java -jar $JETTY_HOME/start.jar --remove-module=http2c