Bug 2499928 (CVE-2026-10051)

Summary:	CVE-2026-10051 jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abrianik, anthomas, anujha, aschwart, asoldano, asyoung, aszczucz, ataylor, bbaranow, bmaxwell, boliveir, bstansbe, ccranfor, chfoley, dbruscin, dfreiber, dlofthou, drichtar, drow, ehelms, ehugonne, ewittman, fmariani, ggainey, ggrzybek, gmalinko, istudens, ivassile, iweiss, janstey, jburrell, jhollowa, jpasqual, jpechane, jraez, juwatts, jwon, kaycoth, kgaikwad, kvanderr, mcarlett, mdellweg, mhulan, mosmerov, mposolda, msvehla, nipatil, nmoumoul, nwallace, osousa, pantinor, parichar, pberan, pcreech, pesilva, pjindal, pmackay, prichard, rchan, rgodfrey, rhel-process-autobot, rkubis, rmartinc, rstancel, rstepani, sdawley, smallamp, ssilvert, sthirugn, sthorger, swoodman, tasato, tcunning, thjenkin, tmalecek, vdosoudi, vkumar, vmuzikar, watson-tool-maintainers, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously retained trailers, or a combination of previous and current request trailers.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2511590, 2511591, 2511592
Bug Blocks:

Description OSIDB Bzimport 2026-07-14 10:01:32 UTC

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.
Subsequent request that do not have trailers report the trailers of the first request.
Subsequent request that do have trailers report the union of trailers of the first request and the current request.

Comment 3 errata-xmlrpc 2026-09-03 22:01:41 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.18 for RHEL 9

Via RHSA-2026:63386 https://access.redhat.com/errata/RHSA-2026:63386

Comment 4 errata-xmlrpc 2026-09-03 22:57:23 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:63387 https://access.redhat.com/errata/RHSA-2026:63387

Comment 5 errata-xmlrpc 2026-09-03 22:58:13 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2026:63327 https://access.redhat.com/errata/RHSA-2026:63327

Comment 6 errata-xmlrpc 2026-09-10 16:37:29 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.14.1

Via RHSA-2026:66488 https://access.redhat.com/errata/RHSA-2026:66488

Comment 7 errata-xmlrpc 2026-09-10 23:25:29 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.13.6

Via RHSA-2026:66545 https://access.redhat.com/errata/RHSA-2026:66545