Race Condition Vulnerability in Jetty Server by Eclipse Foundation
CVE-2026-12611

8.7HIGH

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Jetty
Vendor
CVE Published:
8 September 2026

What is CVE-2026-12611?

A race condition in the Jetty server can be triggered by client-issued HTTP/2 requests, leading to a state where blocking writes are indefinitely halted. This occurs when RST_STREAM and GOAWAY frames are mishandled, resulting in the HTTP2Flusher.terminated being reset to null. As a result, critical entries meant to unblock write-blocked threads become enqueued but remain unprocessed, ultimately rendering the entire server unresponsive.

Affected Version(s)

Eclipse Jetty 12.1.0 <= 12.1.10

Eclipse Jetty 12.0.0 <= 12.0.37

Eclipse Jetty 11.00 <= 11.0.31

References

https://github.com/jetty/jetty.project/security/advisorie...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.