CVE-2026-1605

What it actually does

Unreleased JDK Inflater objects allocated for decompressing gzip-encoded HTTP requests leak when the corresponding response is not compressed, because GzipHandler ties release to response compression.

Why it matters to the business

Repeated requests can exhaust server memory leading to application slowdowns or crashes and loss of service availability for users and dependent systems.

How an attack unfolds

An attacker repeatedly sends HTTP requests carrying Content-Encoding: gzip where the server generates an uncompressed response; each request allocates an Inflater that is never released, gradually consuming heap until the process becomes unresponsive or crashes.

How to fix it

Upgrade Eclipse Jetty to a version containing the fix for the GzipHandler release logic once released; until then disable GzipHandler for request decompression or enforce that all responses to gzip requests are also compressed.

How to confirm the fix worked

Confirm Jetty version is updated, review heap dumps or GC logs for accumulating Inflater objects under gzip request load, and test that memory usage remains stable after applying the change.

Typical attack path

1. Identify Jetty endpoints accepting gzip-encoded requests
2. Craft and send requests with Content-Encoding: gzip that elicit uncompressed responses
3. Repeat the requests at volume to accelerate memory consumption
4. Monitor for service degradation or out-of-memory conditions

How to detect it

Monitor JVM heap usage and GC activity for steady growth correlated with gzip request volume; inspect access logs for repeated Content-Encoding: gzip entries paired with uncompressed responses; review thread or object histograms for unreleased Inflater instances.

What your security team should do

• Prioritize upgrade of all Jetty 12.x instances as soon as a patched release is available
• Temporarily disable request gzip decompression or enforce symmetric compression on responses
• Add memory and request-pattern monitoring to detect anomalous consumption
• Track EPSS and exploit maturity updates for changes in risk posture