Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / CVE-2026-2332

kritisch

CVE-2026-2332

org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing

Veröffentlicht Geändert CWE 444
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (hoch), Red Hat (hoch), AlmaLinux (hoch), Oracle (hoch).

Beschreibung

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
alma 9jmc8.2.0-19.el9_8.2
chainguardakhq, apache-hop, apache-hop-fips und 43 weitere0.27.0-r2 und 37 weitere
debian 11jetty9kein Fix angegeben
debian 12jetty9kein Fix angegeben
debian 13jetty12, jetty9kein Fix angegeben
debian 14jetty12, jetty912.0.33-1
echoairbyte-source-postgres, jetty12, jetty93.8.8+e2
echo maven::Echo OSVorg.eclipse.jetty:jetty-http10.0.26+echo.1
maven::GitHub Security Advisory Mavenorg.eclipse.jetty:jetty-http12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60
minimosapache-nifi, apache-nifi-registry, cassandra-reaper und 20 weitere2.9.0-r0 und 17 weitere
Oracle Linux 9jmc8.2.0-19.el9_8.2
rapidfort debian 12jetty12, jetty90:12.0.33-1
Alle 136 Einträge aus 18 Quellen zeigen
QuellePaketBehoben in
alma 9jmc8.2.0-19.el9_8.2
chainguardakhq0.27.0-r2
chainguardapache-hop2.18.0-r0
chainguardapache-hop-fips2.18.0-r0
chainguardapache-jena-fuseki6.0.0-r5
chainguardapache-nifi2.9.0-r0
chainguardapache-pulsar-4.04.0.10-r0
chainguardapache-pulsar-4.24.2.1-r0
chainguardapache-pulsar-fips-4.04.0.10-r0
chainguardapache-pulsar-fips-4.24.2.1-r0
chainguardapache-tika-3.03.0.0-r31
chainguardapache-tika-3.13.1.0-r38
chainguardapache-tika-3.23.2.3-r18
chainguardapache-tika-3.33.3.2-r2
chainguardapache-tika-fips-3.03.0.0-r13
chainguardapache-tika-fips-3.13.1.0-r15
chainguardapache-tika-fips-3.23.2.3-r13
chainguardapache-tika-fips-3.33.3.2-r4
chainguardautomq1.7.4-r1
chainguardautomq-fips1.7.4-r1
chainguardcassandra-reaper5.0.0-r0
chainguardceleborn-0.50.5.4-r26
chainguardclojure-tools1.12.5.1654-r0
chainguardcloudwatch-exporter0.18.0-r5
chainguardcruise-control2.5.146-r1
chainguardcruise-control-fips2.5.146-r2
chainguarddata-prepper2.16.0-r2
chainguarddruid37.0.0-r56
chainguardjenkins-22.560-r0
chainguardjenkins-2.5552.555.2-r3
chainguardkafka-4.14.1.2-r2
chainguardkafka-4.24.2.0-r5
chainguardkafka-fips-4.14.1.2-r2
chainguardkafka-fips-4.24.2.1-r0
chainguardneo4j-5.265.26.25-r1
chainguardpinot1.5.1-r0
chainguardpinot-fips1.5.1-r0
chainguardreposilite3.6.1-r0
chainguardsolr-1010.0.0-r1
chainguardspark-fips-4.14.1.2-r10
chainguardspark-kubernetes-operator0.9.0-r0
chainguardspark-kubernetes-operator-fips0.9.0-r0
chainguardstrimzi-kafka-operator1.0.0-r8
chainguardstrimzi-kafka-operator-fips1.1.0-r5
chainguardtrino483-r7
chainguardwso2is7.3.0-r0
chainguardzaproxy2.17.0-r12
debian 11jetty9kein Fix angegeben
debian 12jetty9kein Fix angegeben
debian 13jetty12kein Fix angegeben
debian 13jetty9kein Fix angegeben
debian 14jetty1212.0.33-1
debian 14jetty9kein Fix angegeben
echoairbyte-source-postgres3.8.8+e2
echojetty12kein Fix angegeben
echojetty9kein Fix angegeben
echo maven::Echo OSVorg.eclipse.jetty:jetty-http10.0.26+echo.1
maven::GitHub Security Advisory Mavenorg.eclipse.jetty:jetty-http12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60
minimosapache-nifi2.9.0-r0
minimosapache-nifi-registry2.9.0-r0
minimoscassandra-reaper5.0.0-r0
minimoscloudwatch-exporter0.17.0-r0
minimosjenkins2.556-r0
minimosjenkins-2.5552.555.2-r0
minimosjetty-12.012.0.33-r0
minimosjetty-12.0-fips12.0.33-r0
minimosjetty-12.112.1.7-r0
minimosjetty-12.1-fips12.1.7-r0
minimosjetty-9.49.4.58-r1
minimoskafka-3.93.9.2-r5
minimoskafka-4.24.2.1-r0
minimoskafka-4.2-fips4.2.1-r0
minimosneo4j-2026.022026.02.3-r0
minimosneo4j-5.265.26.23-r0
minimosstrimzi-kafka-operator1.0.1-r4
minimosstrimzi-kafka-operator-0.450.45.2-r11
minimosstrimzi-kafka-operator-0.500.50.1-r4
minimosstrimzi-kafka-operator-fips0.51.0-r1
minimosstrimzi-kafka-operator-fips-0.500.50.1-r1
minimostrino481-r4
minimostrino-fips481-r4
Oracle Linux 9jmc8.2.0-19.el9_8.2
rapidfort debian 12jetty120:12.0.33-1
rapidfort debian 12jetty9kein Fix angegeben
rapidfort debian 13jetty120:12.0.33-1
rapidfort debian 13jetty9kein Fix angegeben
rapidfort fedora 43jetty9.4.40-18.fc43
rapidfort fedora 43jetty-client9.4.40-18.fc43
rapidfort fedora 43jetty-continuation9.4.40-18.fc43
rapidfort fedora 43jetty-http9.4.40-18.fc43
rapidfort fedora 43jetty-io9.4.40-18.fc43
rapidfort fedora 43jetty-jaas9.4.40-18.fc43
rapidfort fedora 43jetty-javadoc9.4.40-18.fc43
rapidfort fedora 43jetty-jmx9.4.40-18.fc43
rapidfort fedora 43jetty-security9.4.40-18.fc43
rapidfort fedora 43jetty-server9.4.40-18.fc43
rapidfort fedora 43jetty-servlet9.4.40-18.fc43
rapidfort fedora 43jetty-util9.4.40-18.fc43
rapidfort fedora 43jetty-util-ajax9.4.40-18.fc43
rapidfort fedora 43jetty-webapp9.4.40-18.fc43
rapidfort fedora 43jetty-xml9.4.40-18.fc43
Red Hatjetty-httpkein Fix angegeben
Red Hatpuppetserverkein Fix angegeben
Red Hatsatellite-capsule:el8::puppetserverkein Fix angegeben
seal maven::Seal Security Databaseorg.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999, 3.4.2+sp999, 3.4.3+sp2
seal maven::Seal Security Databaseorg.apache.spark:spark-core_2.112.4.8+sp999
seal maven::Seal Security Databaseorg.apache.spark:spark-core_2.134.0.1+sp999
seal maven::Seal Security Databaseorg.eclipse.jetty:jetty-http10.0.19+sp999, 10.0.22+sp999, 10.0.26+sp2, 11.0.23+sp999, 11.0.24+sp2, 9.4.51.v20230217+sp2, 9.4.53.v20231009+sp999, 9.4.56.v20240826+sp999
seal maven::Seal Security Databaseseal.sp1.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999, 3.4.2+sp999, 3.4.3+sp999
seal maven::Seal Security Databaseseal.sp1.org.apache.spark:spark-core_2.112.4.8+sp999
seal maven::Seal Security Databaseseal.sp1.org.apache.spark:spark-core_2.134.0.1+sp999
seal maven::Seal Security Databaseseal.sp1.org.eclipse.jetty:jetty-http10.0.19+sp999, 10.0.22+sp999, 10.0.26+sp999, 11.0.23+sp999, 11.0.24+sp999, 9.4.51.v20230217+sp999, 9.4.53.v20231009+sp999, 9.4.56.v20240826+sp999
seal maven::Seal Security Databaseseal.sp2.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999, 3.4.2+sp999
seal maven::Seal Security Databaseseal.sp2.org.apache.spark:spark-core_2.112.4.8+sp999
seal maven::Seal Security Databaseseal.sp2.org.eclipse.jetty:jetty-http9.4.53.v20231009+sp999, 9.4.56.v20240826+sp999
seal maven::Seal Security Databaseseal.sp3.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999
seal maven::Seal Security Databaseseal.sp4.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999
seal maven::Seal Security Databaseseal.sp5.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999
seal maven::Seal Security Databaseseal.sp6.org.apache.hadoop:hadoop-client-runtime3.4.1+sp999
seal Red Hat 8libsolv0.7.20-6.el8+sp999
seal Red Hat 8seal-libsolv0.7.20-6.el8+sp999
wolfiakhq0.27.0-r2
wolfiapache-nifi2.9.0-r0
wolfiapache-pulsar-4.24.2.1-r0
wolfiapache-tika-3.13.1.0-r38
wolfiapache-tika-3.23.2.3-r18
wolfiapache-tika-3.33.3.2-r2
wolficassandra-reaper5.0.0-r0
wolficloudwatch-exporter0.18.0-r5
wolfidruid37.0.0-r56
wolfijenkins-22.560-r0
wolfikafka-4.14.1.2-r2
wolfikafka-4.24.2.0-r5
wolfisolr-1010.0.0-r1
wolfistrimzi-kafka-operator1.0.0-r8
wolfitrino483-r7

Referenzen

Alle 37 Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.