Is CVE-2026-1605 actively exploited?

No active exploitation of CVE-2026-1605 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-1605 be exploited remotely?

Yes. CVE-2026-1605 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-1605?

CVE-2026-1605 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-1605

HIGH

CVE-2026-1605

CWE-400Published: March 5, 2026· Updated: Mar 6, 2026

7.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.7th

Official Description

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.

This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response.

In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.

NVD Source

Technical Analysis

CVE-2026-1605 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.5.