Skip to main content

Eclipse Jetty EUVDEUVD-2026-22243

| CVE-2026-2332 CRITICAL
HTTP Request/Response Smuggling (CWE-444)
2026-04-14 eclipse GHSA-355h-qmc2-wpwf
Code Injection Request Smuggling Eclipse Jetty Eclipse Foundation
9.1
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-444
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service HTTP request consistency
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jun 30, 2026

HTTP request smuggling in Eclipse Jetty's HTTP/1.1 parser lets remote unauthenticated attackers desynchronize front-end/back-end request boundaries by abusing quoted-string chunk extensions. Jetty incorrectly terminates chunk-extension parsing at a CRLF located inside an unterminated quoted-string (e.g. 1;a=") rather than rejecting it, so attacker-controlled bytes are reinterpreted as a second, smuggled request on the same TCP connection. Publicly available exploit code exists (a working Python PoC ships in the GHSA advisory), though EPSS is very low (0.03%, 9th percentile) and the issue is not on CISA KEV.

Earlier versions of this analysis (4)
v4 Jun 30, 2026 - 03:46 cvss changed CVSS 9.1

HTTP request smuggling in Eclipse Jetty's HTTP/1.1 parser lets remote attackers desynchronize request boundaries by abusing quoted-string handling in chunk extensions. The parser terminates a chunk extension at the CRLF inside an unclosed quoted string instead of rejecting it (an RFC 9112/9110 violation), so bytes meant as the extension value are reinterpreted as a second, smuggled request. A working proof-of-concept exists (SSVC: poc) that returns two HTTP responses over one TCP connection, but the CVE is not in CISA KEV and EPSS is very low (0.03%, 9th percentile), so this is publicly available exploit code rather than confirmed active exploitation.

v3 Jun 30, 2026 - 03:46 cvss changed CVSS 9.1

HTTP request smuggling in Eclipse Jetty's HTTP/1.1 parser allows remote unauthenticated attackers to desynchronize front-end/back-end request boundaries by abusing chunk extensions. Affecting Jetty 9.4.x through 12.1.x, the parser incorrectly terminates chunk-extension parsing at a CRLF embedded inside a quoted string rather than rejecting it as an error, letting a smuggled second request ('funky chunks' technique) slip past intermediaries. SSVC rates technical impact as total and a proof-of-concept exists, though EPSS exploitation probability is very low (0.03%) and there is no public exploit identified at time of analysis.

v2 Jun 30, 2026 - 03:46 cvss changed CVSS 9.1

HTTP request smuggling in Eclipse Jetty's HTTP/1.1 parser lets remote unauthenticated attackers desynchronize front-end/back-end request boundaries by abusing malformed chunk extensions ('funky chunks' technique). Because Jetty stops parsing chunk-extension quoted strings at an embedded CRLF instead of rejecting it as a protocol error, an attacker can hide a second request inside the chunk extension and have it interpreted as a standalone request by a downstream component. Publicly available exploit code exists (SSVC: PoC) but it is not listed in CISA KEV; EPSS is very low (0.03%), so no public exploit identified as actively used at time of analysis.

v1 Apr 14, 2026 - 12:14 CVSS 7.4

HTTP request smuggling in Eclipse Jetty versions 9.4.0-12.1.6 allows remote unauthenticated attackers to inject smuggled requests via malformed chunked transfer encoding. The HTTP/1.1 parser incorrectly terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as a protocol violation, enabling 'funky chunks' smuggling techniques. This affects all major Jetty version branches (9.4.x, 10.0.x, 11.0.x, 12.0.x, and 12.1.x). EPSS data not available, no confirmed active exploitation (CISA KEV negative), but publicly documented attack techniques exist.

Affected VersionsENISA

Eclipse Jetty 12.0.0 ≤12.0.32
Eclipse Jetty 10.0.0 ≤10.0.27
Eclipse Jetty 12.1.0 ≤12.1.6
Eclipse Jetty 11.0.0 ≤11.0.27
Eclipse Jetty 9.4.0 ≤9.4.59

Affected Packages

maven org.eclipse.jetty:jetty-http fix: 9.4.60, 10.0.28, 11.0.29, 12.0.33, 12.1.7
euvd eclipse_jetty no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Eclipse Jetty gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
ENISA EUVD HIGH
vuln.today AI 8.7 HIGH

Network, unauthenticated, no UI, but realistic exploitation needs a parsing-divergent front-end (AC:H); smuggling crosses a trust boundary into a separate component (S:C) with high confidentiality/integrity impact and no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
SUSE 7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat 7.4 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

4
Severity Changed
Jun 30, 2026 - 03:24 NVD
HIGH CRITICAL
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.4 (HIGH) 9.1 (CRITICAL)
Patch released
Apr 15, 2026 - 02:30 nvd
Patch available
CVE Published
Apr 14, 2026 - 10:59 nvd
HIGH 7.4

DescriptionNVD

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here:

  • https://w4ke.info/2025/06/18/funky-chunks.html
  • https://w4ke.info/2025/10/29/funky-chunks-2.html

Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error.

POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked

1;ext="val X 0

GET /smuggled HTTP/1.1 ...

Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 244 maven packages depend on org.eclipse.jetty:jetty-http (25 direct, 219 indirect)

Ecosystem-wide dependent count for version 12.1.0.

Executive ViewAI

Why It Matters

Eclipse Jetty-based web applications face a critical request-smuggling vulnerability (CVE-2026-2332, CVSS 9.1) that enables unauthenticated attackers to bypass authentication and manipulate application logic through malformed HTTP chunk extensions. Publicly available exploit code exists, though real-world exploitation probability remains extremely low (EPSS 0.03%). Organizations must inventory all Jetty instances and apply vendor patches within 30 days.

Recommended Action

Within 24 hours: inventory all systems running Eclipse Jetty and identify internet-exposed instances. Within 7 days: obtain vendor-released Jetty patch and begin staged deployment on external-facing systems. Within 30 days: complete patching of all Jetty instances and validate via automated scanning to confirm HTTP/1.1 parser fix.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 91% exploitable
Threat Intel
2
1 sources
Data Quality
9 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment NCSC-NL GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

51
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: +5

Attack Technique

HTTP Request Smuggling HIGH

HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries.

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

More in Eclipse Jetty

View all
CVE-2026-18661 HIGH
8.8 Oct 15

Security-constraint bypass in Eclipse Jetty leaves some request URL patterns unprotected when annotation and deployment-
CVE-2026-19204 HIGH
8.7 Sep 07

Unauthenticated remote denial-of-service in Eclipse Jetty's WebSocket implementation allows any network-accessible clien
CVE-2026-12611 HIGH
8.7 Sep 08

HTTP/2 thread-exhaustion denial-of-service in Eclipse Jetty allows unauthenticated remote clients to permanently block a
CVE-2026-19203 HIGH
8.3 Sep 08

HTTP/1.1 request smuggling in Eclipse Jetty allows unauthenticated remote attackers to desynchronize request boundary pa
CVE-2026-77711 HIGH
8.2 Oct 15

Eclipse Jetty's HttpClient can disclose proxy authentication credentials to a malicious server when the server returns a
CVE-2026-76184 HIGH
8.2 Oct 15

Path-normalization weakness in Eclipse Jetty's HttpClient causes credential disclosure: when HttpClient receives a redir
CVE-2026-5795 HIGH
7.4 Apr 08

Privilege escalation in Eclipse Jetty 9.4.0-12.1.7 allows unauthenticated remote attackers to bypass authentication via

CVE-2026-76182 MEDIUM
6.9 Oct 15

Query-parameter injection in Eclipse Jetty's TryPathsHandler and TryFilesFilter allows unauthenticated remote attackers

CVE-2026-10051 MEDIUM
6.9 Jul 14

HTTP/1.1 trailer leakage in Eclipse Jetty allows a remote unauthenticated attacker to read trailer headers from a previo
CVE-2026-6790 MEDIUM
5.3 Jul 14

Eclipse Jetty fails to enforce RFC 9110/9112's requirement that the HTTP request authority (host and port) match the val
CVE-2026-8384 MEDIUM
5.3 Jul 14

Eclipse Jetty mishandles HTTP URI path parameters containing semicolons combined with traversal sequences, delivering an

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2026-48710 MEDIUM POC
6.5
CVE-2021-33037 MEDIUM
5.3
CVE-2026-88773 CRITICAL POC
9.3
CVE-2021-23336 MEDIUM POC
5.9
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/357304 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-2332 REF https://access.redhat.com/errata/RHSA-2026:10175 REF https://access.redhat.com/errata/RHSA-2026:14272 REF https://access.redhat.com/errata/RHSA-2026:17668 REF https://access.redhat.com/errata/RHSA-2026:20568 REF https://access.redhat.com/errata/RHSA-2026:21773 REF https://access.redhat.com/errata/RHSA-2026:22453 REF https://access.redhat.com/errata/RHSA-2026:25089 REF https://access.redhat.com/errata/RHSA-2026:50221 REF https://access.redhat.com/errata/RHSA-2026:50222 REF https://access.redhat.com/errata/RHSA-2026:50223 REF https://access.redhat.com/errata/RHSA-2026:50263 REF https://access.redhat.com/errata/RHSA-2026:60239 REF https://access.redhat.com/errata/RHSA-2026:60246 REF https://access.redhat.com/errata/RHSA-2026:60247 REF https://access.redhat.com/errata/RHSA-2026:60248 REF https://access.redhat.com/errata/RHSA-2026:60249 REF https://access.redhat.com/errata/RHSA-2026:60250 REF https://access.redhat.com/errata/RHSA-2026:60251 REF https://access.redhat.com/errata/RHSA-2026:60252 REF https://access.redhat.com/errata/RHSA-2026:60254 REF https://access.redhat.com/errata/RHSA-2026:60256 REF https://access.redhat.com/errata/RHSA-2026:60259 REF https://access.redhat.com/security/cve/CVE-2026-2332 REF https://bugzilla.redhat.com/show_bug.cgi?id=2458187 REF https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf REF https://gitlab.eclipse.org/security/cve-assignment/-/issues/89 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy