crítica
CVE-2026-2332
org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta), Red Hat (alta), AlmaLinux (alta), Oracle (alta).
Descripción
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 9 | jmc | 8.2.0-19.el9_8.2 |
| chainguard | akhq, apache-hop, apache-hop-fips y 43 más | 0.27.0-r2 y 37 más |
| debian 11 | jetty9 | sin corrección indicada |
| debian 12 | jetty9 | sin corrección indicada |
| debian 13 | jetty12, jetty9 | sin corrección indicada |
| debian 14 | jetty12, jetty9 | 12.0.33-1 |
| echo | airbyte-source-postgres, jetty12, jetty9 | 3.8.8+e2 |
| echo maven::Echo OSV | org.eclipse.jetty:jetty-http | 10.0.26+echo.1 |
| maven::GitHub Security Advisory Maven | org.eclipse.jetty:jetty-http | 12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60 |
| minimos | apache-nifi, apache-nifi-registry, cassandra-reaper y 20 más | 2.9.0-r0 y 17 más |
| Oracle Linux 9 | jmc | 8.2.0-19.el9_8.2 |
| rapidfort debian 12 | jetty12, jetty9 | 0:12.0.33-1 |
Mostrar las 136 entradas de 18 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 9 | jmc | 8.2.0-19.el9_8.2 |
| chainguard | akhq | 0.27.0-r2 |
| chainguard | apache-hop | 2.18.0-r0 |
| chainguard | apache-hop-fips | 2.18.0-r0 |
| chainguard | apache-jena-fuseki | 6.0.0-r5 |
| chainguard | apache-nifi | 2.9.0-r0 |
| chainguard | apache-pulsar-4.0 | 4.0.10-r0 |
| chainguard | apache-pulsar-4.2 | 4.2.1-r0 |
| chainguard | apache-pulsar-fips-4.0 | 4.0.10-r0 |
| chainguard | apache-pulsar-fips-4.2 | 4.2.1-r0 |
| chainguard | apache-tika-3.0 | 3.0.0-r31 |
| chainguard | apache-tika-3.1 | 3.1.0-r38 |
| chainguard | apache-tika-3.2 | 3.2.3-r18 |
| chainguard | apache-tika-3.3 | 3.3.2-r2 |
| chainguard | apache-tika-fips-3.0 | 3.0.0-r13 |
| chainguard | apache-tika-fips-3.1 | 3.1.0-r15 |
| chainguard | apache-tika-fips-3.2 | 3.2.3-r13 |
| chainguard | apache-tika-fips-3.3 | 3.3.2-r4 |
| chainguard | automq | 1.7.4-r1 |
| chainguard | automq-fips | 1.7.4-r1 |
| chainguard | cassandra-reaper | 5.0.0-r0 |
| chainguard | celeborn-0.5 | 0.5.4-r26 |
| chainguard | clojure-tools | 1.12.5.1654-r0 |
| chainguard | cloudwatch-exporter | 0.18.0-r5 |
| chainguard | cruise-control | 2.5.146-r1 |
| chainguard | cruise-control-fips | 2.5.146-r2 |
| chainguard | data-prepper | 2.16.0-r2 |
| chainguard | druid | 37.0.0-r56 |
| chainguard | jenkins-2 | 2.560-r0 |
| chainguard | jenkins-2.555 | 2.555.2-r3 |
| chainguard | kafka-4.1 | 4.1.2-r2 |
| chainguard | kafka-4.2 | 4.2.0-r5 |
| chainguard | kafka-fips-4.1 | 4.1.2-r2 |
| chainguard | kafka-fips-4.2 | 4.2.1-r0 |
| chainguard | neo4j-5.26 | 5.26.25-r1 |
| chainguard | pinot | 1.5.1-r0 |
| chainguard | pinot-fips | 1.5.1-r0 |
| chainguard | reposilite | 3.6.1-r0 |
| chainguard | solr-10 | 10.0.0-r1 |
| chainguard | spark-fips-4.1 | 4.1.2-r10 |
| chainguard | spark-kubernetes-operator | 0.9.0-r0 |
| chainguard | spark-kubernetes-operator-fips | 0.9.0-r0 |
| chainguard | strimzi-kafka-operator | 1.0.0-r8 |
| chainguard | strimzi-kafka-operator-fips | 1.1.0-r5 |
| chainguard | trino | 483-r7 |
| chainguard | wso2is | 7.3.0-r0 |
| chainguard | zaproxy | 2.17.0-r12 |
| debian 11 | jetty9 | sin corrección indicada |
| debian 12 | jetty9 | sin corrección indicada |
| debian 13 | jetty12 | sin corrección indicada |
| debian 13 | jetty9 | sin corrección indicada |
| debian 14 | jetty12 | 12.0.33-1 |
| debian 14 | jetty9 | sin corrección indicada |
| echo | airbyte-source-postgres | 3.8.8+e2 |
| echo | jetty12 | sin corrección indicada |
| echo | jetty9 | sin corrección indicada |
| echo maven::Echo OSV | org.eclipse.jetty:jetty-http | 10.0.26+echo.1 |
| maven::GitHub Security Advisory Maven | org.eclipse.jetty:jetty-http | 12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60 |
| minimos | apache-nifi | 2.9.0-r0 |
| minimos | apache-nifi-registry | 2.9.0-r0 |
| minimos | cassandra-reaper | 5.0.0-r0 |
| minimos | cloudwatch-exporter | 0.17.0-r0 |
| minimos | jenkins | 2.556-r0 |
| minimos | jenkins-2.555 | 2.555.2-r0 |
| minimos | jetty-12.0 | 12.0.33-r0 |
| minimos | jetty-12.0-fips | 12.0.33-r0 |
| minimos | jetty-12.1 | 12.1.7-r0 |
| minimos | jetty-12.1-fips | 12.1.7-r0 |
| minimos | jetty-9.4 | 9.4.58-r1 |
| minimos | kafka-3.9 | 3.9.2-r5 |
| minimos | kafka-4.2 | 4.2.1-r0 |
| minimos | kafka-4.2-fips | 4.2.1-r0 |
| minimos | neo4j-2026.02 | 2026.02.3-r0 |
| minimos | neo4j-5.26 | 5.26.23-r0 |
| minimos | strimzi-kafka-operator | 1.0.1-r4 |
| minimos | strimzi-kafka-operator-0.45 | 0.45.2-r11 |
| minimos | strimzi-kafka-operator-0.50 | 0.50.1-r4 |
| minimos | strimzi-kafka-operator-fips | 0.51.0-r1 |
| minimos | strimzi-kafka-operator-fips-0.50 | 0.50.1-r1 |
| minimos | trino | 481-r4 |
| minimos | trino-fips | 481-r4 |
| Oracle Linux 9 | jmc | 8.2.0-19.el9_8.2 |
| rapidfort debian 12 | jetty12 | 0:12.0.33-1 |
| rapidfort debian 12 | jetty9 | sin corrección indicada |
| rapidfort debian 13 | jetty12 | 0:12.0.33-1 |
| rapidfort debian 13 | jetty9 | sin corrección indicada |
| rapidfort fedora 43 | jetty | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-client | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-continuation | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-http | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-io | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-jaas | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-javadoc | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-jmx | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-security | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-server | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-servlet | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-util | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-util-ajax | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-webapp | 9.4.40-18.fc43 |
| rapidfort fedora 43 | jetty-xml | 9.4.40-18.fc43 |
| Red Hat | jetty-http | sin corrección indicada |
| Red Hat | puppetserver | sin corrección indicada |
| Red Hat | satellite-capsule:el8::puppetserver | sin corrección indicada |
| seal maven::Seal Security Database | org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp999, 3.4.1+sp999, 3.4.2+sp999, 3.4.3+sp2 |
| seal maven::Seal Security Database | org.apache.spark:spark-core_2.11 | 2.4.8+sp999 |
| seal maven::Seal Security Database | org.apache.spark:spark-core_2.13 | 4.0.1+sp999 |
| seal maven::Seal Security Database | org.eclipse.jetty:jetty-http | 10.0.19+sp999, 10.0.22+sp999, 10.0.26+sp2, 11.0.23+sp999, 11.0.24+sp2, 9.4.51.v20230217+sp2, 9.4.53.v20231009+sp999, 9.4.56.v20240826+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp999, 3.4.1+sp999, 3.4.2+sp999, 3.4.3+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.apache.spark:spark-core_2.11 | 2.4.8+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.apache.spark:spark-core_2.13 | 4.0.1+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.eclipse.jetty:jetty-http | 10.0.19+sp999, 10.0.22+sp999, 10.0.26+sp999, 11.0.23+sp999, 11.0.24+sp999, 9.4.51.v20230217+sp999, 9.4.53.v20231009+sp999, 9.4.56.v20240826+sp999 |
| seal maven::Seal Security Database | seal.sp2.org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp999, 3.4.1+sp999, 3.4.2+sp999 |
| seal maven::Seal Security Database | seal.sp2.org.apache.spark:spark-core_2.11 | 2.4.8+sp999 |
| seal maven::Seal Security Database | seal.sp2.org.eclipse.jetty:jetty-http | 9.4.53.v20231009+sp999, 9.4.56.v20240826+sp999 |
| seal maven::Seal Security Database | seal.sp3.org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp999, 3.4.1+sp999 |
| seal maven::Seal Security Database | seal.sp4.org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp999, 3.4.1+sp999 |
| seal maven::Seal Security Database | seal.sp5.org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp999, 3.4.1+sp999 |
| seal maven::Seal Security Database | seal.sp6.org.apache.hadoop:hadoop-client-runtime | 3.4.1+sp999 |
| seal Red Hat 8 | libsolv | 0.7.20-6.el8+sp999 |
| seal Red Hat 8 | seal-libsolv | 0.7.20-6.el8+sp999 |
| wolfi | akhq | 0.27.0-r2 |
| wolfi | apache-nifi | 2.9.0-r0 |
| wolfi | apache-pulsar-4.2 | 4.2.1-r0 |
| wolfi | apache-tika-3.1 | 3.1.0-r38 |
| wolfi | apache-tika-3.2 | 3.2.3-r18 |
| wolfi | apache-tika-3.3 | 3.3.2-r2 |
| wolfi | cassandra-reaper | 5.0.0-r0 |
| wolfi | cloudwatch-exporter | 0.18.0-r5 |
| wolfi | druid | 37.0.0-r56 |
| wolfi | jenkins-2 | 2.560-r0 |
| wolfi | kafka-4.1 | 4.1.2-r2 |
| wolfi | kafka-4.2 | 4.2.0-r5 |
| wolfi | solr-10 | 10.0.0-r1 |
| wolfi | strimzi-kafka-operator | 1.0.0-r8 |
| wolfi | trino | 483-r7 |
Referencias
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/errata/RHSA-2026:14272
- https://access.redhat.com/errata/RHSA-2026:17668
- https://access.redhat.com/errata/RHSA-2026:20568
- https://access.redhat.com/errata/RHSA-2026:21773
- https://access.redhat.com/errata/RHSA-2026:22453
- https://access.redhat.com/errata/RHSA-2026:25089
- https://access.redhat.com/errata/RHSA-2026:50221
Las 37 referencias
- https://access.redhat.com/errata/RHSA-2026:50222
- https://access.redhat.com/errata/RHSA-2026:50223
- https://access.redhat.com/errata/RHSA-2026:50263
- https://access.redhat.com/errata/RHSA-2026:60239
- https://access.redhat.com/errata/RHSA-2026:60246
- https://access.redhat.com/errata/RHSA-2026:60247
- https://access.redhat.com/errata/RHSA-2026:60248
- https://access.redhat.com/errata/RHSA-2026:60249
- https://access.redhat.com/errata/RHSA-2026:60250
- https://access.redhat.com/errata/RHSA-2026:60251
- https://access.redhat.com/errata/RHSA-2026:60252
- https://access.redhat.com/errata/RHSA-2026:60254
- https://access.redhat.com/errata/RHSA-2026:60256
- https://access.redhat.com/errata/RHSA-2026:60259
- https://access.redhat.com/security/cve/CVE-2026-2332
- https://advisory.echohq.com/cve/CVE-2026-2332
- https://bugzilla.redhat.com/2419500
- https://bugzilla.redhat.com/2458187
- https://bugzilla.redhat.com/show_bug.cgi?id=2458187
- https://errata.almalinux.org/9/ALSA-2026-20568.html
- https://github.com/jetty/jetty.project
- https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/89
- https://linux.oracle.com/cve/CVE-2026-2332.html
- https://linux.oracle.com/errata/ELSA-2026-20568.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-2332
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json
- https://w4ke.info/2025/06/18/funky-chunks.html
- https://www.cve.org/CVERecord?id=CVE-2026-2332