{"id":"ECHO-7ace-751a-c022","summary":"Jetty 12-only (GHSA range 12.0.0-12.0.31 / 12.1.0-12.1.5). The leaking code is Jetty 12's\nGzipHandler/GzipRequest, where GzipRequest.destroy() (which returns the Inflater to the\npool) only ran through GzipResponseAndCallback when the response was also deflated. In\n10.0.26, request inflation is a GzipHttpInputInterceptor (implements Destroyable)\ninstalled on HttpInput. AsyncContentProducer.recycle() destroys it after every request,\nwhether or not the response is deflated.\n","modified":"2026-11-04T13:15:05.628974065Z","published":"2026-09-30T11:25:20.758Z","withdrawn":"2026-11-03T21:45:06.385Z","upstream":["CVE-2026-1605","GHSA-xxh7-fcf3-rj7f"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-1605"}],"affected":[{"package":{"name":"org.eclipse.jetty:jetty-server","ecosystem":"Echo:Maven","purl":"pkg:maven/org.eclipse.jetty/jetty-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.26+echo.3"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-7ace-751a-c022.json"}}],"schema_version":"1.9.2"}