Log in Start free

Vulnerability · Published Apr 14, 2026 · Assigned by eclipse

CVE-2026-2332HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

High 7.4

In plain English

A high-severity security flaw in Eclipse Jetty from Eclipse Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)1.3%top 29.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9jmc8.2.0-19.el9_8.2ALSA-2026:20568
Debian:13jetty12no fix listedDEBIAN-CVE-2026-2332
Debian:14jetty1212.0.33-1DEBIAN-CVE-2026-2332
Debian:12jetty9no fix listedDEBIAN-CVE-2026-2332
Debian:13jetty9no fix listedDEBIAN-CVE-2026-2332
Debian:14jetty9no fix listedDEBIAN-CVE-2026-2332
Mavenorg.eclipse.jetty:jetty-http9.4.60GHSA-355h-qmc2-wpwf
Mavenorg.eclipse.jetty:jetty-http12.0.33GHSA-355h-qmc2-wpwf
Mavenorg.eclipse.jetty:jetty-http12.1.7GHSA-355h-qmc2-wpwf
Mavenorg.eclipse.jetty:jetty-http11.0.29GHSA-355h-qmc2-wpwf
Mavenorg.eclipse.jetty:jetty-http10.0.28GHSA-355h-qmc2-wpwf
Rocky Linux:9jmc0:8.2.0-19.el9_8.2RLSA-2026:20568
Ubuntu:26.04:LTSjetty12no fix listedUBUNTU-CVE-2026-2332
Ubuntu:26.10jetty12no fix listedUBUNTU-CVE-2026-2332
Ubuntu:22.04:LTSjetty9no fix listedUBUNTU-CVE-2026-2332
Ubuntu:24.04:LTSjetty9no fix listedUBUNTU-CVE-2026-2332
Ubuntu:25.10jetty9no fix listedUBUNTU-CVE-2026-2332
Ubuntu:26.04:LTSjetty9no fix listedUBUNTU-CVE-2026-2332
Ubuntu:26.10jetty9no fix listedUBUNTU-CVE-2026-2332

Affected products (as reported)

VendorProductVersions
Eclipse Foundation Eclipse Jetty 12.1.0 – through 12.1.612.0.0 – through 12.0.3211.0.0 – through 11.0.2810.0.0 – through 10.0.279.4.0 – through 9.4.59

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References