Special Thanks to the following Eclipse Jetty community members

• @zenios (Dimitris Zenios)

Changelog

• #15496 - mime-type filtering by IncludeExclude should always be case-insensitive
• #15456 - Fragments in redirects not supported by default in standalone Jetty installation
• #15453 - HttpServletResponse: setHeader("Content-Length", N) should be treated like setContentLengthLong(N)
• #13970 - ForwardedRequestCustomizer uses connection port instead of proto default when host lacks port (@zenios)
• #577 - AbstractProxyServlet onServerResponseHeaders addHeader rather than setHeader

Changelog

• #15345 - Move RateControl to jetty-io
• #15308 - CachingWebAppClassLoader is not registering as parallel capable
• #15267 - Introduce module for MinimumDataRateHandler
• #15234 - Review error response codes from EagerContentHandler
• #15232 - Jetty 12.1.x EE11 doesn't handle Session attributes properly
• #15228 - Fix increased in memory usage between 12.1.8 and 12.1.10 caused by ZipFileSystems
• #15226 - Server becomes inaccessible with thousands of qtp threads blocked in HttpChannelState.onIdleTimeout ReentrantLock
• #15217 - jetty-quic-quiche-foreign fails on Windows due to eager resolution of Unix-only quiche_conn_set_keylog_fd
• #15156 - Injecting authentication headers using request filters

Changelog

• #15180 - Upgrade to Quiche version 0.29.1
• #15161 - Reduce memory footprint for persistent HttpConnections
• #15136 - Refresh Digest authentication implementation
• #15118 - Upgrade to Quiche version 0.29.0
• #15094 - Jetty 12.1 Regression: Deferred Authentication provides Callback.NOT_CALLED leading to errors
• #15074 - HTTP/2 extended connect responses contain Content-Length: 0
• #15031 - IOResources#toRetainableByteBuffer data loss when using resources without path
• #15021 - Resource handling regression in 12.1.9
• #15011 - PathResource.resolve() fails on Microsoft Windows due to Illegal char <:>
• #15009 - Make processing of RST_STREAM more lenient
• #14984 - XmlConfiguration emits "Deprecated method ... setMaxThreads" WARN from shipped jetty-threadpool-virtual.xml
• #14745 - NPE in HttpChannelState.completeStream() when _request is null during multipart cleanup
• #14528 - BinaryStreamTest.testMoreThanLargestMessageOneByteAtATime() is flaky
• #14522 - Bundle org.eclipse.jetty.websocket.server OSGI metadata exports internal instead of public package
• #14006 - How to handle "Warning Logs in org.eclipse.jetty.ee8.nested.HttpChannelState and org.eclipse.jetty.server.internal.HttpChannelState"
• #9799 - Declare EncodingException for HPACK/QPACK encoders and decoders

Changelog

• #14972 - Jetty 12.1.8 jetty-home has lib/*-config.jar files
• #14913 - Upgrade to Quiche version 0.28.0
• #14870 - Refactor compliance checks
• #14853 - CombinedResource.getRealURI() returns null when multiple members exist, causing 404 for all static resources
• #14846 - NPE in MimeTypes$Mutable.getMimeByExtension on startup with web-fragment with mime mapping
• #14824 - FileSystemPool doesn't always own its filesystems
• #14821 - Websocket IllegalStateException ('Demand already fulfilled') since Jetty 12.1
• #14805 - HTTP/3 server crashes on quiche_header_info
• #14646 - Regression in Jetty 12.1: Invalid UTF-8 exception for application/x-www-form-urlencoded; charset=iso-8859-1
• #14564 - Jetty 12.1.x TLS connections hang after several requests with internal HTTPS self-requests
• #14541 - Jetty HTTP Client - setMaxRequestHeadersSize resulting in java.lang.OutOfMemoryError
• #14196 - Using passivation with eviction: HttpServletRequest.getSession() may return null due to race-condition
• #12110 - Request Authority checks needed
• #8876 - Jetty 12 - JMX-ify HttpContent.Factory implementations

Special Thanks to the following Eclipse Jetty community members

• @afarber (Alexander Farber)

Changelog

• 14757 Fixes for JASPI isMandatory, authType and isAuthenticationRequest params - Addresses CVE-2026-5795
• #14752 - Jetty 12.1 Violation of RFC9113 with Host and :authority headers
• #14747 - Revert usage of SLF4J2 fluent APIs
• #14732 - possible race condition in jetty 12.x code
• #14694 - Sync jetty-ee11 with jetty-ee10
• #14689 - ThreadIdPool.take() bottlenecks QueuedThreadPool.tryExecute()
• #14687 - Destinations don't keep track of redirections.
• #14685 - CachingHttpContentFactory#getContent may return null if httpContent size is not set
• #14651 - Retain negative Max-Age cookie attribute
• #14494 - Review use of CharsetStringBuilder subclasses
• #14431 - ServletContainerInitializers are always excluded when used with absolute-ordering
• #14332 - Complete mess with idleTimeout
• #13685 - Infinite loop on Content.copy() with Content.Source.from(... , Path, ) when Path has size 0.
• #13513 - Make MemoryEndPoint use RBB.DynamicCapacity (@afarber)
• #10906 - Add Slf4j ConsoleRequestLog (JettySlf4jRequestLog) module

Changelog

• #15503 - Remove LF_CHUNK_TERMINATION from non-legacy HttpCompliance modes (12.0)
• #15501 - cleanups to WebSocket RFC6455Handshaker and Parser (12.0)
• #15428 - Backport of #15307.

Changelog

• #15289 - FileSystemPool fails to mount a jar located under a non-ASCII path ("Bad escape")
• #15226 - Server becomes inaccessible with thousands of qtp threads blocked in HttpChannelState.onIdleTimeout ReentrantLock

Changelog

• #15161 - Reduce memory footprint for persistent HttpConnections
• #15136 - Refresh Digest authentication implementation
• #14745 - NPE in HttpChannelState.completeStream() when _request is null during multipart cleanup
• #14692 - 12.0.x: H2 client should abort the active channel's request during close or failure
• #14006 - How to handle "Warning Logs in org.eclipse.jetty.ee8.nested.HttpChannelState and org.eclipse.jetty.server.internal.HttpChannelState"

Changelog

• #14973 - cherry-pick of URIUtil cleanups for Jetty 12.0.x
• #14870 - Refactor compliance checks

Changelog

• #14798 - Fixes for JASPI isMandatory, authType and isAuthenticationRequest params - Addresses CVE-2026-5795
• #14743 - Jetty 12.0.x Add isDebugEnabled guard before log.debug
• #14642 - 12.0.x Remove usage of Slf4j fluent api
• #14494 - Review use of CharsetStringBuilder subclasses
• #14332 - Fix idleTimeout for websocket