EUVD-2026-43641
GHSA-c269-4hpf-qfhc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires proxy-backend topology for effective smuggling (AC:H); scope changes as attacker affects other users' sessions (S:C); limited confidentiality and integrity impact align with request smuggling primitives.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
2DescriptionCVE.org
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling.
AnalysisAI
HTTP request smuggling in Eclipse Grizzly before 5.0.2 stems from the framework's inability to correctly parse malformed trailer header lines in chunked HTTP requests, enabling CWE-444 boundary-confusion attacks. Remote unauthenticated attackers who can send crafted chunked requests through a front-end proxy to a GlassFish-backed server can cause the proxy and Grizzly to disagree on request boundaries, smuggling attacker-controlled content as the prefix of a subsequent legitimate user's request. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 4.0 AT:P condition signals that specific deployment prerequisites must be met.
Technical ContextAI
Eclipse Grizzly is a Java NIO-based HTTP server framework that functions as the embedded HTTP connector for Eclipse GlassFish. The flaw is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests - HTTP Request Smuggling): when an HTTP/1.1 chunked message includes a trailer section with a malformed header line, Grizzly's parser fails to correctly identify the request boundary. A front-end reverse proxy that parses the same message differently then forwards a byte stream that Grizzly interprets as two separate HTTP requests - one legitimate and one injected by the attacker. The affected CPE cpe:2.3:a:eclipse_foundation:eclipse_glassfish:*:*:*:*:*:*:*:* confirms Eclipse GlassFish as the affected product family, with Grizzly being its HTTP layer; the CVE description names Grizzly specifically as the component containing the parser defect.
RemediationAI
Upgrade Eclipse Grizzly to version 5.0.2 or later, as stated in the CVE description as the fixed release. GlassFish operators should update to the GlassFish distribution that bundles Grizzly 5.0.2 or later; the exact corresponding GlassFish fix version is not confirmed from available data and must be verified via the Eclipse advisory at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/129. Where immediate patching is not possible, deploy a strict front-end proxy or WAF configured to normalize chunked transfer-encoding and reject or strip malformed trailer headers before forwarding to GlassFish - note this adds processing overhead and may interfere with legitimate use of HTTP trailers (e.g., gRPC trailing metadata). Restricting chunked-encoding with trailers at the network perimeter is a narrower control with fewer side effects if the application does not rely on trailer functionality.
More in Eclipse Glassfish
View allServer-Side Request Forgery combined with CSRF in Eclipse GlassFish's DownloadServlet ContentSources handler allows a re
Remote code execution in Eclipse GlassFish allows remote attackers to evaluate arbitrary Expression Language (EL) expres
Remote code execution in Eclipse GlassFish allows attackers with administrative access to the Administration Console to
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today