CVE-2026-19203 Details
Description
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.
A vulnerability in Eclipse Jetty's HTTP chunked request parsing allows for HTTP request smuggling. This issue arises because Jetty versions 9.4.0 through 12.1.11, when configured to comply with RFC7230 or RFC2616, accept a lone LF character as a valid chunk extension. This misinterpretation can create discrepancies in how request boundaries are perceived by Jetty and any intermediary proxies, potentially leading to request smuggling attacks. In contrast, Jetty 12.1.12 and later versions default to RFC9110 compliance, which disallows such violations. However, if explicitly set to RFC7230 or RFC2616, even the latest Jetty 12.1.10 version becomes vulnerable.
Users can upgrade to Jetty versions 12.1.12, 12.0.38, 11.0.32, 10.0.32, or 9.4.64, all of which have patched this vulnerability. For those using Jetty 12.1.X, it's important to ensure the server is configured to default to RFC9110 compliance, which disallows the vulnerable LF chunk extension.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 8, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eclipse Jetty | >= 12.1.0, <= 12.1.11 (semver) >= 12.0.0, <= 12.0.37 (semver) >= 11.0.0, <= 11.0.31 (semver) >= 10.0.0, <= 10.0.31 (semver) >= 9.4.0, <= 9.4.63 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2026 | New CVE Received | [email protected] |