CVE-2026-2332 Details
Description
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
A request smuggling vulnerability has been identified in Eclipse Jetty's HTTP/1.1 parser, affecting versions 9.4.0 through 9.4.59, 10.0.0 through 10.0.27, 11.0.0 through 11.0.27, 12.0.0 through 12.0.32, and 12.1.0 through 12.1.6. The issue arises because Jetty improperly handles chunked transfer encoding extensions in quoted strings, allowing an attacker to inject smuggled requests. This vulnerability is a variant of the 'Funky Chunks' request smuggling technique, where the chunk extension parsing is terminated at carriage return and line feed (CRLF) sequences within quotes, instead of recognizing it as an error. As a result, injected requests can bypass normal processing and potentially exploit other vulnerabilities or access controls.
Users can upgrade to Jetty versions 9.4.60, 10.0.28, 11.0.28, or 12.1.7 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | redhat-SADP |
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| eclipse jetty | >= 9.4.0, < 9.4.60 >= 10.0.0, < 10.0.28 >= 11.0.0, < 11.0.28 >= 12.0.0, < 12.0.33 >= 12.1.0, < 12.1.7 |
CPE
Remediation
| |
Change History
24 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | redhat-SADP |
| Sep 9, 2026 | CVE Modified | redhat-SADP |
| Sep 7, 2026 | CVE Modified | redhat-SADP |
| Sep 3, 2026 | CVE Modified | redhat-SADP |
| Aug 27, 2026 | CVE Modified | redhat-SADP |
| Aug 26, 2026 | CVE Modified | [email protected] |
| Aug 26, 2026 | CVE Modified | redhat-SADP |
| Aug 24, 2026 | CVE Modified | redhat-SADP |
| Aug 21, 2026 | CVE Modified | redhat-SADP |
| Aug 17, 2026 | CVE Modified | [email protected] |
| Aug 17, 2026 | CVE Modified | redhat-SADP |
| Aug 14, 2026 | CVE Modified | redhat-SADP |
| Aug 10, 2026 | CVE Modified | redhat-SADP |
| Aug 5, 2026 | CVE Modified | redhat-SADP |
| Aug 3, 2026 | CVE Modified | redhat-SADP |
| Jul 23, 2026 | CVE Modified | redhat-SADP |
| Jul 20, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 2, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | New CVE Received | [email protected] |