NES for Jetty 10.0.x Release Notes

Security Fixes

• Fixed a condition where threads could remain blocked when handling reset HTTP/2 requests (CVE-2026-12611).
• Fixed HTTP request smuggling caused by lax parsing of LF terminators in chunked transfer-encoding extensions in jetty-http (CVE-2026-19203).
• Fixed a WebSocket flaw where a reserved opcode could bypass the frame-size limit, leading to out-of-memory (OOM) (CVE-2026-19204).

Security Fixes

• Fixed improper input validation in jetty-http where malformed URIs were parsed differently than other common parsers, potentially allowing blocklist bypass in multi-component systems (CVE-2025-11143).

Security Fixes

• Digest Authentication bypass via ISO-8859-1 character encoding collision (CVE-2026-10050).

Security Fixes

• Missing validation of HTTP request authority against the Host header, potentially leading to incorrect URI construction and virtual host selection (CVE-2026-6790).

Security Fixes

• JASPI access control escalation (CVE-2026-5795).

Security Fixes

• HTTP Request Smuggling via Chunked Extension Quoted-String Parsing (CVE-2026-2332).

Security Fixes

• Fixed improper input validation in jetty-http where malformed URIs were parsed differently than other common parsers, potentially allowing blocklist bypass in multi-component systems (CVE-2025-11143). (Resolved in 10.0.31.1)

Notes

• This release originates from the open-source Eclipse Jetty by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Jetty 10.0.26.