12.1.8

Special Thanks to the following Eclipse Jetty community members

• @afarber (Alexander Farber)

Changelog

• 14757 Fixes for JASPI isMandatory, authType and isAuthenticationRequest params - Addresses CVE-2026-5795
• #14752 - Jetty 12.1 Violation of RFC9113 with Host and :authority headers
• #14747 - Revert usage of SLF4J2 fluent APIs
• #14732 - possible race condition in jetty 12.x code
• #14694 - Sync jetty-ee11 with jetty-ee10
• #14689 - ThreadIdPool.take() bottlenecks QueuedThreadPool.tryExecute()
• #14687 - Destinations don't keep track of redirections.
• #14685 - CachingHttpContentFactory#getContent may return null if httpContent size is not set
• #14651 - Retain negative Max-Age cookie attribute
• #14494 - Review use of CharsetStringBuilder subclasses
• #14431 - ServletContainerInitializers are always excluded when used with absolute-ordering
• #14332 - Complete mess with idleTimeout
• #13685 - Infinite loop on Content.copy() with Content.Source.from(... , Path, ) when Path has size 0.
• #13513 - Make MemoryEndPoint use RBB.DynamicCapacity (@afarber)
• #10906 - Add Slf4j ConsoleRequestLog (JettySlf4jRequestLog) module

12.0.34

Changelog

• #14798 - Fixes for JASPI isMandatory, authType and isAuthenticationRequest params - Addresses CVE-2026-5795
• #14743 - Jetty 12.0.x Add isDebugEnabled guard before log.debug
• #14642 - 12.0.x Remove usage of Slf4j fluent api
• #14494 - Review use of CharsetStringBuilder subclasses
• #14332 - Fix idleTimeout for websocket

12.1.7

Special Thanks to the following Eclipse Jetty community members

• @afarber (Alexander Farber)

Changelog

• #14566 - CompressionHandler/GzipEncoderSink not respect setSyncFlush(true)
• #14495 - Support Transfer-Encoding chunk extensions - Addresses CVE-2026-2332
• #14485 - Illegal header value on UTF-8 encoding when using HTTP/2
• #14442 - Allow splitting of Transfer-Encoding chunks
• #14436 - Jetty 12.1.6 HttpFields from(HttpField...) does not provide opportunity to set compliance listener (@afarber)
• #14435 - NoSuchMethodError error raised by HttpStateChannel with Jetty 12.1.6 run with maven plugin
• #14408 - Redundant database index created by JDBCSessionDataStore
• #14373 - Response listener that avoids any data copies
• #14366 - Clarify Deprecation Policy
• #14165 - Integrating Eclipse Soteria with Jetty EE10+

12.0.33

Changelog

• #14570 - Backport of #14496.
• #14520 - Backport fix and test the multipart auto cleanup in HttpChannelState in 12.0.x
• #14495 - Support Transfer-Encoding chunk extensions

12.1.6

Special Thanks to the following Eclipse Jetty community members

• @afarber (Alexander Farber)

Changelog

• #14360 - jetty-ee8-cdi missing from jetty-ee8-bom
• #14330 - VirtualThreadPool can create unlimited threads while doc mentions otherwise
• #14319 - ZSTD CompressionHandler may duplicate bytes in response (@afarber)
• #14280 - jetty-ee11-servlets mistakenly depends on jetty-client
• #14264 - org.eclipse.jetty.server.Response.sendRedirect doesn't allow a location containing a fragment (/#fragment)
• #14260 - Improve GZIP performance
• #14209 - Unable to use custom XmlParser for WebAppContext / MetaData descriptor parsing
• #14137 - 304 Not Modified produces incorrect ETag from CompressionHandler.
• #14068 - Jetty tmpdir processing doesn't match Java on Windows
• #14061 - Jetty 12.1.4 demo HTTP/3 wrong port in alt-svc response header (@afarber)
• #13686 - Improve grow algorithms
• #13670 - jetty-ee11-servlet getParameter does not throw IllegalStateException
• #13353 - Create a glossary in the documentation (@afarber)
• #13328 - Add option to share thread pool in ProxyHandler (@afarber)
• #12806 - ComplianceViolation.Listener isn't very useful for helping identify clients that need to migrate to standards
• #12660 - Tagging the ClientUpgradeRequest to be able to support per-request client ssl auth
• #11505 - Document HttpURI methods (@afarber)
• #10905 - Support cookie name prefixes (@afarber)
• #10355 - Http3Fields efficiency
• #10281 - pom.xml description tags need updated
• #9019 - Server cannot be closed gracefully when ServerConnector's IdleTimeout is 0

12.0.32

Changelog

• #14360 - jetty-ee8-cdi missing from jetty-ee8-bom
• #14260 - Improve GZIP performance

12.1.5

Changelog

• #14097 - Can't use Jetty when the default Locale is Azerbaijan
• #14085 - QoSHandler: Allow customization of rejection status code (429 vs 503) and improve extensibility
• #14070 - Invalid logger usage in ThreadPool
• #14063 - Add test scope to jetty-quic-util JUnit dependency
• #14028 - Native memory leak in zstd compression handler
• #14017 - Fix cookie-config web.xml attributes when used with quickstart
• #13993 - Fixes for ThreadLimitHandler with NON_BLOCKING invocation type
• #13964 - HTTP/2 Client infinite reconnection loop
• #13962 - HTTP/2 Client connection timeout does not work

12.0.31

Changelog

• #14132 - 12.0.x: Fix loop caused by NegotiatingClientConnection talking to broken server
• #14130 - 12.0.x: Improve buffer pools stats and dump
• #14097 - Can't use Jetty when the default Locale is Azerbaijan
• #14017 - Fix cookie-config web.xml attributes when used with quickstart
• #14013 - Regular handling of bad URIs
• #14007 - 12.0.x: Rework consumeAvailable() mechanism
• #13993 - Fixes for ThreadLimitHandler with NON_BLOCKING invocation type
• #13962 - HTTP/2 Client connection timeout does not work

12.1.4

Special Thanks to the following Eclipse Jetty community members

• @julianladisch (Julian Ladisch)
• @arsenalzp (Oleksandr Krutko)
• @guptas6est (guptas6est)

Changelog

• #14004 - Fix NPE in SecurityHandler, List can have restrictions on contains(null)
• #13993 - Jetty 12 server deadlock
• #13976 - Allow configuring the default max local streams on the H2 client
• #13973 - Fix Multipart cleanup in HttpChannelState
• #13971 - ContentSinkOutputStream does not have idempotent close
• #13962 - HTTP/2 Client connection timeout does not work
• #13945 - Document deployment in programming guide
• #13939 - Add an asByteArrayAsync method taking promise for Content.Source
• #13936 - Version12.1.3 breaks BINARY compatibility with 12.0.29: HttpContent.getByteBuffer() and more
• #13931 - Introduce ConditionalHandler.NextElseReject
• #13924 - Merge PR #13887 to 12.1.x - fix servlet filter mappings with quickstart
• #13922 - ResourceServlet Download link broken
• #13915 - You can not have both Frame and Text handler in 12.1.x Jetty websocket
• #13896 - listener.onContent( ... ) clears that ByteBuffer before the call.
• #13886 - Servlet filter mappings not working with quickstart
• #13883 - Invalid logger usage in HttpOutput
• #13850 - FileMappingHttpContentFactory change in 12.1.x still serves old files, even when last modified date on file changes
• #13849 - Connection reset on HTTP/2 when using CompressionHandler with default WindowRateControl
• #13841 - Warn the first time the TCCL fails to be set
• #13837 - Limit ReservedThread creation (@arsenalzp)
• #13833 - CompressionHandler shouldn't compress response with specific status codes
• #13832 - Introduced SecurityHandler.PathMethodMapped
• #13812 - NullPointerException in GzipEncoderSink, breaking all requests with CompressionHandler
• #13806 - Improved Credential to allow stronger password checksums.
• #13768 - Sanitizing of HTTP headers names and values should remove NUL bytes (U+0000)
• #13689 - eeX-demo-mock-resources.mod incorrectly depends on eeX-annotations
• #13685 - Infinite loop on Content.copy() with Content.Source.from(... , Path, ) when Path has size 0.
• #13677 - Make ContextHandler catch and ignore exceptions thrown by Thread.setContextClassLoader()
• #13672 - Improve CSV Compliance
• #13634 - Avoid sending RST_STREAM for closed streams
• #13619 - AbstractConnector Javadoc continues to reference legacy default acceptor thread calculation
• #13512 - disable detectOfflineLinks of m-javadoc-plugin and add test to ensure javadoc:jar still works fine with eclipse-release profile
• #13470 - Jetty 12.0: ManagedSession issues due to recursion and/pr multiple completions of the stream.
• #13335 - Servlet Upgrade Support is too eager
• #13323 - jetty.requestlog.timezone not working
• #13290 - Consider changing 12.1 websocket-core to consume frame buffers on sendFrame
• #13643 - Consume WebSocket buffers in CoreSession.sendFrame
• #12720 - Error attributes not set on request in Jetty 12
• #12023 - [12.1.x] Remove deprecated classes/methods
• #3515 - Review Uptime

12.0.30

Special Thanks to the following Eclipse Jetty community members

• @julianladisch (Julian Ladisch)
• @guptas6est (guptas6est)

Changelog

• #13983 - 12.0.x: Fix error handling from jsp with post form
• #13978 - 12.0.x: allow configuring the default max local streams on the H2 client
• #13962 - HTTP/2 Client connection timeout does not work
• #13933 - completeStream changes introduced "Unconsumed" bug
• #13922 - ResourceServlet Download link broken
• #13886 - Servlet filter mappings not working with quickstart
• #13849 - Connection reset on HTTP/2 when using CompressionHandler with default WindowRateControl
• #13842 - 12.0.x: warn the first time the TCCL fails to be set
• #13613 - HttpInput#read rethrows already thrown exception, leading to possible self-suppressing exception issue
• #13470 - Jetty 12.0: ManagedSession issues due to recursion and/pr multiple completions of the stream.
• #13413 - Fix <license><name> by using SPDX in pom.xml (@julianladisch)