{"cve":"CVE-2026-10051","nvd":{"published":"2026-07-14T09:16:39.783","modified":"2026-10-24T22:10:00.210","status":"Analyzed","description":"In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.\nSubsequent request that do not have trailers report the trailers of the first request.\nSubsequent request that do have trailers report the union of trailers of the first request and the current request.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-200"],"references":["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119"],"products":["eclipse:jetty"],"source":"nvd","synced_at":"2026-10-25T17:50:06.907763985+00:00"},"epss":{"cve":"CVE-2026-10051","score":0.00429,"percentile":0.36892,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-f4v5-65jj-pcr2","url":"https://osv.dev/vulnerability/GHSA-f4v5-65jj-pcr2","summary":"Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections","modified":"2026-09-10T03:50:51.882727145Z","packages":[{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-server","purl":"pkg:maven/org.eclipse.jetty/jetty-server","ranges":[">=12.0.0 <12.0.36"],"fixed":["12.0.36"]},{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-server","purl":"pkg:maven/org.eclipse.jetty/jetty-server","ranges":[">=12.1.0 <12.1.10"],"fixed":["12.1.10"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}