DEBIAN-CVE-2026-12611

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-12611
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-12611.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-12611
Upstream
Published
2026-09-08T13:17:17Z
Modified
2026-09-12T11:00:06Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client. The race condition "resets" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads.

References

Affected packages

Debian:13 / jetty12

Package

Name
jetty12
Purl
pkg:deb/debian/jetty12?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

12.*
12.0.17-3
12.0.17-3.1~deb13u1
12.0.17-3.1
12.0.32-1
12.0.32-2
12.0.33-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-12611.json"

Debian:14 / jetty12

Package

Name
jetty12
Purl
pkg:deb/debian/jetty12?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

12.*
12.0.17-3
12.0.17-3.1~deb13u1
12.0.17-3.1
12.0.32-1
12.0.32-2
12.0.33-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-12611.json"

Debian:12 / jetty9

Package

Name
jetty9
Purl
pkg:deb/debian/jetty9?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.4.50-4
9.4.50-4+deb12u1
9.4.50-4+deb12u2
9.4.50-4+deb12u3
9.4.51-1
9.4.51-2
9.4.52-1
9.4.53-1
9.4.54-1
9.4.55-1
9.4.56-1
9.4.57-0+deb12u1
9.4.57-1
9.4.57-1.1~deb12u1
9.4.57-1.1~deb13u1
9.4.57-1.1
9.4.58-1
9.4.58-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-12611.json"

Debian:13 / jetty9

Package

Name
jetty9
Purl
pkg:deb/debian/jetty9?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.4.57-1
9.4.57-1.1~deb12u1
9.4.57-1.1~deb13u1
9.4.57-1.1
9.4.58-1
9.4.58-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-12611.json"

Debian:14 / jetty9

Package

Name
jetty9
Purl
pkg:deb/debian/jetty9?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.4.57-1
9.4.57-1.1~deb12u1
9.4.57-1.1~deb13u1
9.4.57-1.1
9.4.58-1
9.4.58-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-12611.json"