EUVD-2026-72718
GHSA-p2j5-5566-vpv9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires a differentially-parsing proxy intermediary; S:C because smuggling impacts other users' requests beyond the attacker's own session.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
2DescriptionCVE.org
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.
This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.
AnalysisAI
HTTP/1.1 request smuggling in Eclipse Jetty allows unauthenticated remote attackers to desynchronize request boundary parsing between Jetty and an upstream proxy, enabling manipulation of other users' HTTP sessions. The root cause is Jetty's acceptance of a bare LF character (\n) as a line terminator during chunked transfer encoding parsing - specifically in chunk extensions, chunk data termination, or trailer termination - where RFC 7230 mandates CRLF (\r\n). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) Jetty must be deployed behind an HTTP intermediary proxy or load balancer (e.g., nginx, HAProxy, AWS ALB, Apache httpd) that parses chunked encoding boundaries strictly per RFC CRLF rules; (2) the attacker must be able to send raw HTTP/1.1 chunked requests to the proxy endpoint (port 80/443 typically - no authentication required per PR:N); and (3) the proxy must forward the mangled chunked body to Jetty rather than normalizing or rejecting lone-LF terminators. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N, score 8.3) accurately captures network reachability and unauthenticated access, but AT:P (attack requirements present) is the critical limiting signal: exploitation requires a differentially-parsing intermediary proxy between the attacker and the Jetty backend. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the patched Eclipse Jetty version identified in the GitHub Security Advisory GHSA-xc35-c22g-239h (https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h); exact fix versions are not confirmed in the available input data and must be verified from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all production and development systems to locate Eclipse Jetty deployments and document installed versions and upstream proxy configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Eclipse Jetty
View allHTTP request smuggling in Eclipse Jetty's HTTP/1.1 parser lets remote unauthenticated attackers desynchronize front-end/
Unauthenticated remote denial-of-service in Eclipse Jetty's WebSocket implementation allows any network-accessible clien
HTTP/2 thread-exhaustion denial-of-service in Eclipse Jetty allows unauthenticated remote clients to permanently block a
Privilege escalation in Eclipse Jetty 9.4.0-12.1.7 allows unauthenticated remote attackers to bypass authentication via
HTTP/1.1 trailer leakage in Eclipse Jetty allows a remote unauthenticated attacker to read trailer headers from a previo
Eclipse Jetty fails to enforce RFC 9110/9112's requirement that the HTTP request authority (host and port) match the val
Eclipse Jetty mishandles HTTP URI path parameters containing semicolons combined with traversal sequences, delivering an
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today