CVE-2026-10051 Eclipse Foundation CVE debrief

Who should care

Users of Eclipse Jetty, particularly those responsible for configuration and security, should verify their setups to ensure proper handling of HTTP/1.1 requests with trailers. This includes reviewing current configurations, updating or patching as necessary, and implementing compensating controls to monitor and limit the impact of unintended trailer retention. Operators, platform administrators, vulnerability management teams, and security teams are all relevant stakeholders who should be aware of this issue and take appropriate action.

Technical summary

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent requests that do not have trailers report the trailers of the first request. Subsequent requests that do have trailers report the union of trailers of the first request and the current request. This behavior can lead to unintended trailer retention and potential information disclosure. Affected product context indicates that Eclipse Jetty users are impacted, and defensive impact suggests that configurations should be reviewed to mitigate this issue.

Defensive priority

Medium priority given the CVSS score of 6.9 and the potential for information disclosure.

Recommended defensive actions

• Verify and update Eclipse Jetty configurations to properly handle HTTP/1.1 requests with trailers.
• Implement compensating controls to monitor and limit the impact of unintended trailer retention.
• Conduct regular inventory checks to ensure all instances of Eclipse Jetty are up-to-date and patched.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide limited details about the vulnerability. Further investigation and verification are necessary to fully understand the impact and scope of the issue. Affected product deployments should be identified, and owners assigned for follow-up. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance. Compensating controls may be necessary for exposed systems while remediation is scheduled and verified.

Official resources