CVE-2026-10051Medium· 5.3▾ SunlitA flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintention…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
0.3% → 0.4%
5.3 → —
— → 5.3
5.3 → —
— → 5.3
5.3 → —
— → 5.3
5.3 → —
— → 5.3
5.3 → —
— → 5.3
5.3 → —
— → 5.3
Last analysed / modified upstream
A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously retained trailers, or a combination of previous and current request trailers.
jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections — rated Moderate by Red Hat. Released 2026-07-14, updated 2026-10-19.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For detailed instructions how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:63327 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For detailed instructions how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:63387 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:63386
Workarounds / mitigations:
Affected packages:
org.eclipse.jetty:jetty-server >= 12.0.0, <= 12.0.35org.eclipse.jetty:jetty-server >= 12.1.0, <= 12.1.9Patched in:
org.eclipse.jetty:jetty-server 12.0.36org.eclipse.jetty:jetty-server 12.1.10Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116190Low· 3.7github.com/rclone/rclone: rclone: Information disclosure via cross-host HTTP redirects (CVE-2026-116190)
CVE-2026-116196Medium· 5.3github.com/rclone/rclone: rclone: Information disclosure via HTTP redirects in B2 backend (CVE-2026-116196)
CVE-2026-115449Low· 3.5Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest
CVE-2026-114126High· 8.8storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token (CVE-2026-114126)
CVE-2024-3656High· 8.1A flaw was found in Keycloak
CVE-2021-38554Medium· 5.3vault: UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser (CVE-2021-38554)