Technical impact
The flaw occurs when an HTTP/1.1 request containing trailers is first processed by an Eclipse Jetty server. Jetty incorrectly retains those trailers and later propagates them to subsequent requests that use the same persistent connection. Requests without trailers end up receiving the stale trailer data from the initial request, whereas requests that include trailers receive a combination of the original and current trailer sets. This inadvertent leakage can expose sensitive metadata or application state from one transaction to a later request, potentially giving an attacker access to confidential information that was not intended for subsequent traffic.
Affected Systems
All installations of Eclipse Jetty are potentially affected unless a vendor‑supplied patch that corrects the trailer handling logic has been applied. The CVE entry lists Eclipse Foundation:Eclipse Jetty as the affected vendor product but does not provide a specific version range. Administrators should verify whether they are running a Jetty release that has been updated to remove the bug.
Risk and Exploitability
With a CVSS score of 6.9 the vulnerability is rated moderate and is unlikely to be widely abused, as reflected by an EPSS score of less than 1% and its absence from the CISA KEV catalog. Attackers would need to send malicious HTTP/1.1 requests that exploit the persistent connection mechanics and trigger the trailer‑handling code path. Because the issue is purely a protocol processing flaw, it can be exercised remotely without local privileges, but requires the ability to send crafted HTTP requests to the Jetty server over a network that allows trailers.
Github GHSA