Log in Start free

Vulnerability · Published Sep 8, 2026 · Assigned by eclipse

CVE-2026-19203

High 8.3

In plain English

A high-severity security flaw in Eclipse Jetty from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.3High
Exploit odds (30 days)0.3%top 76.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13jetty12no fix listedDEBIAN-CVE-2026-19203
Debian:14jetty1212.0.39-1DEBIAN-CVE-2026-19203
Debian:12jetty9no fix listedDEBIAN-CVE-2026-19203
Debian:13jetty9no fix listedDEBIAN-CVE-2026-19203
Debian:14jetty9no fix listedDEBIAN-CVE-2026-19203
Ubuntu:26.04:LTSjetty12no fix listedUBUNTU-CVE-2026-19203
Ubuntu:26.10jetty12no fix listedUBUNTU-CVE-2026-19203
Ubuntu:22.04:LTSjetty9no fix listedUBUNTU-CVE-2026-19203
Ubuntu:24.04:LTSjetty9no fix listedUBUNTU-CVE-2026-19203
Ubuntu:26.04:LTSjetty9no fix listedUBUNTU-CVE-2026-19203
Ubuntu:26.10jetty9no fix listedUBUNTU-CVE-2026-19203

Affected products (as reported)

VendorProductVersions
Eclipse Foundation Eclipse Jetty 12.1.0 – through 12.1.1112.0.0 – through 12.0.3711.0.0 – through 11.0.3110.0.0 – through 10.0.319.4.0 – through 9.4.63

Weakness: CWE-444 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

References