UBUNTU-CVE-2026-12611

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-12611
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12611.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-12611
Upstream
Published
2026-09-14T00:00:00Z
Modified
2026-09-14T11:17:16Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client. The race condition "resets" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads.

References

Affected packages

Ubuntu:16.04:LTS
jetty9

Package

Name
jetty9
Purl
pkg:deb/ubuntu/jetty9?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.2.14-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "jetty9",
            "binary_version": "9.2.14-1"
        },
        {
            "binary_name": "libjetty9-extra-java",
            "binary_version": "9.2.14-1"
        },
        {
            "binary_name": "libjetty9-java",
            "binary_version": "9.2.14-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12611.json"
Ubuntu:18.04:LTS
jetty9

Package

Name
jetty9
Purl
pkg:deb/ubuntu/jetty9?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.2.22-2
9.2.22-3
9.2.23-1
9.4.15-1~18.04.1ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "jetty9",
            "binary_version": "9.4.15-1~18.04.1ubuntu1"
        },
        {
            "binary_name": "libjetty9-extra-java",
            "binary_version": "9.4.15-1~18.04.1ubuntu1"
        },
        {
            "binary_name": "libjetty9-java",
            "binary_version": "9.4.15-1~18.04.1ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12611.json"
Ubuntu:20.04:LTS
jetty9

Package

Name
jetty9
Purl
pkg:deb/ubuntu/jetty9?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.4.18-2build2
9.4.26-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "jetty9",
            "binary_version": "9.4.26-1"
        },
        {
            "binary_name": "libjetty9-extra-java",
            "binary_version": "9.4.26-1"
        },
        {
            "binary_name": "libjetty9-java",
            "binary_version": "9.4.26-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12611.json"
Ubuntu:22.04:LTS
jetty9

Package

Name
jetty9
Purl
pkg:deb/ubuntu/jetty9?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.4.39-3
9.4.44-2
9.4.44-3
9.4.44-4
9.4.45-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "jetty9",
            "binary_version": "9.4.45-1"
        },
        {
            "binary_name": "libjetty9-extra-java",
            "binary_version": "9.4.45-1"
        },
        {
            "binary_name": "libjetty9-java",
            "binary_version": "9.4.45-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12611.json"
Ubuntu:24.04:LTS
jetty9

Package

Name
jetty9
Purl
pkg:deb/ubuntu/jetty9?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.4.51-2
9.4.53-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "jetty9",
            "binary_version": "9.4.53-1"
        },
        {
            "binary_name": "libjetty9-extra-java",
            "binary_version": "9.4.53-1"
        },
        {
            "binary_name": "libjetty9-java",
            "binary_version": "9.4.53-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12611.json"
Ubuntu:26.04:LTS
jetty12

Package

Name
jetty12
Purl
pkg:deb/ubuntu/jetty12?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

12.*
12.0.17-3.1
12.0.32-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "jetty12",
            "binary_version": "12.0.32-1"
        },
        {
            "binary_name": "libjetty12-extra-java",
            "binary_version": "12.0.32-1"
        },
        {
            "binary_name": "libjetty12-java",
            "binary_version": "12.0.32-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12611.json"
jetty9

Package

Name
jetty9
Purl
pkg:deb/ubuntu/jetty9?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.4.57-1
9.4.57-1.1
9.4.58-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "jetty9",
            "binary_version": "9.4.58-1"
        },
        {
            "binary_name": "libjetty9-extra-java",
            "binary_version": "9.4.58-1"
        },
        {
            "binary_name": "libjetty9-java",
            "binary_version": "9.4.58-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12611.json"