CVE catalog

CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive.

[CVE catalog]

Severity
High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 25, 2026

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client. The race condition "resets" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjetty9sid9.4.58-2vulnerable
Debianjetty9forky9.4.58-2vulnerable
Debianjetty9trixie9.4.57-1.1~deb13u1vulnerable
Debianjetty9trixie-security9.4.57-1.1~deb13u1vulnerable
Debianjetty9bookworm9.4.57-1.1~deb12u1vulnerable
Debianjetty9bookworm-security9.4.57-1.1~deb12u1vulnerable
Opensusejetty-minimaltumbleweed9.4.58-6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjetty9sourcesid(unfixed)not yet assignedNot reported[1151846]
Debianjetty9sourceforky(unfixed)not yet assignedNot reported[1151846]
Debianjetty9sourcetrixie(unfixed)not yet assignedNot reported[1151846]
Debianjetty9sourcebookworm(unfixed)not yet assignedNot reported[1151846]
Opensusejetty-minimalrpmtumbleweed9.4.58-6.1Not reportedOPENSUSE-SU-2026:11804-1Not reported

[Debian bug #1151846]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [jetty9]Affected
    Details (4)

    • 9.4.57-1.1~deb12u1 · all · bookworm

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm-security

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm-security

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

  • [libjetty9-extra-java]Affected

    Source package: [jetty9]

    Details (4)

    • 9.4.57-1.1~deb12u1 · all · bookworm

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm-security

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm-security

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

  • [libjetty9-java]Affected

    Source package: [jetty9]

    Details (4)

    • 9.4.57-1.1~deb12u1 · all · bookworm

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm-security

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

    • 9.4.57-1.1~deb12u1 · all · bookworm-security

      Affected

      nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

[Debian 13 (Trixie)]

  • [jetty12]Affected
    Details (4)

    • 12.0.17-3.1~deb13u1 · all · trixie

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty12 · debian · 13

  • [jetty9]Affected
    Details (4)

    • 9.4.57-1.1~deb13u1 · all · trixie

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty9 · debian · 13

  • [libjetty12-extra-java]Affected

    Source package: [jetty12]

    Details (4)

    • 12.0.17-3.1~deb13u1 · all · trixie

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty12 · debian · 13

  • [libjetty12-java]Affected

    Source package: [jetty12]

    Details (4)

    • 12.0.17-3.1~deb13u1 · all · trixie

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty12 · debian · 13

    • 12.0.17-3.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty12 · debian · 13

  • [libjetty9-extra-java]Affected

    Source package: [jetty9]

    Details (4)

    • 9.4.57-1.1~deb13u1 · all · trixie

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty9 · debian · 13

  • [libjetty9-java]Affected

    Source package: [jetty9]

    Details (4)

    • 9.4.57-1.1~deb13u1 · all · trixie

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty9 · debian · 13

    • 9.4.57-1.1~deb13u1 · all · trixie-security

      Affected

      nvd · jetty9 · debian · 13

[openSUSE Tumbleweed]

  • [jetty-annotations]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-6.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-ant]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-6.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-cdi]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-6.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-client]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-6.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-continuation]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-6.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-deploy]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-6.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-fcgi]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-6.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-http]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-6.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-http-spi]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-6.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-io]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-6.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

  • [jetty-jaas]Unknown

    Source package: [jetty-minimal]

    Details (1)

    • 9.4.58-5.1 · noarch · tumbleweed

      Unknown · Fixed: 9.4.58-6.1

      Version impact unknown

      nvd · jetty-minimal · opensuse · tumbleweed

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]