Skip to main content

Eclipse Jetty CVE-2026-2332

| EUVDEUVD-2026-22243 CRITICAL
HTTP Request/Response Smuggling (CWE-444)
2026-04-14 eclipse GHSA-355h-qmc2-wpwf
Code Injection Request Smuggling Eclipse Jetty
9.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
8.7 HIGH

Network, unauthenticated, no UI, but realistic exploitation needs a parsing-divergent front-end (AC:H); smuggling crosses a trust boundary into a separate component (S:C) with high confidentiality/integrity impact and no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
SUSE
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat
7.4 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

13
Analysis Updated
Jun 30, 2026 - 03:49 vuln.today
v5 (cvss_changed)
Source Code Evidence Fetched
Jun 30, 2026 - 03:46 vuln.today
Analysis Updated
Jun 30, 2026 - 03:46 vuln.today
v4 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 03:46 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 03:46 vuln.today
v2 (cvss_changed)
Severity Changed
Jun 30, 2026 - 03:24 NVD
HIGH CRITICAL
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.4 (HIGH) 9.1 (CRITICAL)
Re-analysis Queued
Apr 17, 2026 - 15:37 vuln.today
cvss_changed
Patch released
Apr 15, 2026 - 02:30 nvd
Patch available
Analysis Generated
Apr 14, 2026 - 12:14 vuln.today
EUVD ID Assigned
Apr 14, 2026 - 11:30 euvd
EUVD-2026-22243
Analysis Generated
Apr 14, 2026 - 11:30 vuln.today
CVE Published
Apr 14, 2026 - 10:59 nvd
HIGH 7.4

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 243 maven packages depend on org.eclipse.jetty:jetty-http (25 direct, 218 indirect)

Ecosystem-wide dependent count for version 12.1.0.

DescriptionNVD

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here:

  • https://w4ke.info/2025/06/18/funky-chunks.html
  • https://w4ke.info/2025/10/29/funky-chunks-2.html

Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error.

POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked

1;ext="val X 0

GET /smuggled HTTP/1.1 ...

Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

AnalysisAI

HTTP request smuggling in Eclipse Jetty's HTTP/1.1 parser lets remote unauthenticated attackers desynchronize front-end/back-end request boundaries by abusing quoted-string chunk extensions. Jetty incorrectly terminates chunk-extension parsing at a CRLF located inside an unterminated quoted-string (e.g. 1;a=") rather than rejecting it, so attacker-controlled bytes are reinterpreted as a second, smuggled request on the same TCP connection. Publicly available exploit code exists (a working Python PoC ships in the GHSA advisory), though EPSS is very low (0.03%, 9th percentile) and the issue is not on CISA KEV.

More in Eclipse Jetty

View all
CVE-2026-5795 HIGH
7.4 Apr 08

Privilege escalation in Eclipse Jetty 9.4.0-12.1.7 allows unauthenticated remote attackers to bypass authentication via

CVE-2026-10051 MEDIUM
6.9 Jul 14

HTTP/1.1 trailer leakage in Eclipse Jetty allows a remote unauthenticated attacker to read trailer headers from a previo
CVE-2026-6790 MEDIUM
5.3 Jul 14

Eclipse Jetty fails to enforce RFC 9110/9112's requirement that the HTTP request authority (host and port) match the val
CVE-2026-8384 MEDIUM
5.3 Jul 14

Eclipse Jetty mishandles HTTP URI path parameters containing semicolons combined with traversal sequences, delivering an

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

CVE-2026-2332 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy