Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-12611

Quick assessment

Affected
Eclipse Foundation Eclipse Jetty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

客户端可能向 Jetty 服务器发送 HTTP/2 请求，导致出现阻塞写入操作，且这些阻塞状态永远无法解除，最终导致所有线程被阻塞，整个服务器变得无响应。 此问题是由服务器在处理客户端发送的 RST_STREAM 帧和 GOAWAY 帧时存在的竞态条件（race condition）引起的。 该竞态条件会将 字段从之前设置的非空值“重置”为 null 值，从而允许新的条目被加入队列，但这些条目将永远不会被处理。而这些未处理的条目本应负责解除那些处于写入阻塞状态的线程。

CVSS 8.7 · High

Affected Version Matrix 5

VendorProduct Version RangeStatus
Eclipse Foundation Eclipse Jetty 12.1.0≤ 12.1.10 affected
12.0.0≤ 12.0.37 affected
11.00≤ 11.0.31 affected
10.0.0≤ 10.0.31 affected
9.4.36≤ 9.4.63 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-12611

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client. The race condition "resets" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse Jetty 12.1.0 ~ 12.1.10 -

II. Public POCs for CVE-2026-12611

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-12611

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-12611 (1)

Same Patch Batch · Eclipse Foundation · 2026-09-08 · 5 CVEs total

CVE-2026-86464 9.9 CRITICAL CVE-2026-86464
CVE-2026-84197 9.2 CRITICAL Ditto Node.js客户端 1.0.0-3.9.0 WebSocket TLS验证缺失
CVE-2026-19203 8.3 HIGH Jetty特制HTTP分块请求致请求走私漏洞
CVE-2026-86590 6.3 MEDIUM Eclipse Che 7.79.0-7.121.0 服务端请求伪造（SSRF）

IV. Related Vulnerabilities

Same product: Eclipse Jetty
Same vendor: Eclipse Foundation
Same weakness: CWE-400

V. Comments for CVE-2026-12611

No comments yet

Leave a comment