CVE-2026-12611

Eclipse Jetty contains a denial-of-service flaw in its HTTP/2 server implementation, caused by a race condition when handling RST_STREAM and GOAWAY frames sent by a client. The race condition resets the HTTP2Flusher.terminated field from a non-null value back to null, which allows entries to be enqueued in the flusher that are never processed; these unprocessed entries are the ones that would unblock write-blocked threads. A remote, unauthenticated client can trigger this by issuing HTTP/2 requests that cause blocking writes, eventually leaving all threads blocked and the entire server unresponsive, with availability impact only per the CVSS 4.0 vector. Any Jetty server deployment with HTTP/2 enabled, including Jetty embedded inside other applications and products, is affected. Exploitation has not been observed: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS assigns only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade Jetty (including embedded copies repackaged inside other products) to the fixed version identified in the Eclipse Jetty advisory for CVE-2026-12611, and confirm whether HTTP/2 is enabled on internet-facing endpoints. As an interim mitigation, consider disabling HTTP/2 on exposed Jetty servers or fronting them with a proxy/CDN that terminates HTTP/2, and monitor thread pools for signs of full exhaustion and server unresponsiveness.