CVE-2026-1605High severity
← Search results
AUTOMATICALLY VERIFIEDOFFICIAL VENDOR SOURCECOLLECTED 30 SEP 2026
Jetty · AUTOMATIC DISCOVERY
Eclipse Jetty Lifecycle policy
Eclipse Jetty is tracked by BlackTree as a server-side software product. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
This record passed BlackTree's automatic primary-source checks with a confidence score of 82. It is returned for operational research without requiring routine manual approval. Confirm edition and deployment applicability before acting.
This discovery does not establish a product-specific support or retirement date. A missing date does not mean support continues.
Product overview
Eclipse Jetty is tracked by BlackTree as a server-side software product. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
Main capabilities
- Networked or application service delivery
- Administrative and operational interfaces
- Versioned maintenance and security updates
Typical use
Used to provide application, infrastructure or operational services to other systems and users.
Deployment
Deployed on servers, virtual machines, containers or managed infrastructure.
This category-level context is generated from the registered product identity. Confirm exact product capabilities on the publisher's page .
Collected lifecycle data
| Product | Eclipse Jetty |
|---|---|
| Release | Lifecycle policy |
| Start or release | Not extracted |
| Lifecycle boundary | Continuous or not dated in the source |
| Date precision | Unknown |
Known exploited vulnerabilities
Catalogue updated 29 Sep 2026These are product-family matches in the CISA Known Exploited Vulnerabilities catalogue. Confirm the affected product version in the vendor advisory.
No CISA known-exploited entries currently match this mapped product family.
This does not mean the product has no vulnerabilities.
Package vulnerability advisories
Checked 30 Sep 2026OSV advisories are matched through the registered package URL. A package-family match does not prove that the installed release is affected. Check the affected and fixed versions before remediation.
CVE-2024-13009High severity
**UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request
OSV recordCVE-2024-7708High severity
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
OSV recordCVE-2026-6790Medium severity
Eclipse Jetty: HTTP Authority/Host mismatch
OSV recordCVE-2026-10051Medium severity
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
OSV recordCVE-2024-8184Medium severity
Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks
OSV recordCVE-2023-26048Medium severity
OutOfMemoryError for large multipart without filename in Eclipse Jetty
OSV recordCVE-2023-26049Low severity
Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies
OSV recordSource evidence
PRIMARYManual
Eclipse Jetty official lifecycle source
.tgz | Release Notes / API Docs | 11.0.26 (EOL) | .zip | .tgz
Publisher identity used by product-specific official-source collectors.
Open official vendor source