Attestkeep
Dil: Türkçe
Kayıt ol

Zafiyetler / CVE-2026-2332

kritik

CVE-2026-2332

org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing

Yayın Değişiklik CWE 444
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (yüksek), Red Hat (yüksek), AlmaLinux (yüksek), Oracle (yüksek).

Açıklama

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
alma 9jmc8.2.0-19.el9_8.2
chainguardakhq, apache-hop, apache-hop-fips ve 43 tane daha0.27.0-r2 ve 37 tane daha
debian 11jetty9düzeltme belirtilmemiş
debian 12jetty9düzeltme belirtilmemiş
debian 13jetty12, jetty9düzeltme belirtilmemiş
debian 14jetty12, jetty912.0.33-1
echoairbyte-source-postgres, jetty12, jetty93.8.8+e2
echo maven::Echo OSVorg.eclipse.jetty:jetty-http10.0.26+echo.1
maven::GitHub Security Advisory Mavenorg.eclipse.jetty:jetty-http12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60
minimosapache-nifi, apache-nifi-registry, cassandra-reaper ve 20 tane daha2.9.0-r0 ve 17 tane daha
Oracle Linux 9jmc8.2.0-19.el9_8.2
rapidfort debian 12jetty12, jetty90:12.0.33-1
18 kaynaktaki 136 kaydın hepsini göster
KaynakPaketDüzeltildiği sürüm
alma 9jmc8.2.0-19.el9_8.2
chainguardakhq0.27.0-r2
chainguardapache-hop2.18.0-r0
chainguardapache-hop-fips2.18.0-r0
chainguardapache-jena-fuseki6.0.0-r5
chainguardapache-nifi2.9.0-r0
chainguardapache-pulsar-4.04.0.10-r0
chainguardapache-pulsar-4.24.2.1-r0
chainguardapache-pulsar-fips-4.04.0.10-r0
chainguardapache-pulsar-fips-4.24.2.1-r0
chainguardapache-tika-3.03.0.0-r31
chainguardapache-tika-3.13.1.0-r38
chainguardapache-tika-3.23.2.3-r18
chainguardapache-tika-3.33.3.2-r2
chainguardapache-tika-fips-3.03.0.0-r13
chainguardapache-tika-fips-3.13.1.0-r15
chainguardapache-tika-fips-3.23.2.3-r13
chainguardapache-tika-fips-3.33.3.2-r4
chainguardautomq1.7.4-r1
chainguardautomq-fips1.7.4-r1
chainguardcassandra-reaper5.0.0-r0
chainguardceleborn-0.50.5.4-r26
chainguardclojure-tools1.12.5.1654-r0
chainguardcloudwatch-exporter0.18.0-r5
chainguardcruise-control2.5.146-r1
chainguardcruise-control-fips2.5.146-r2
chainguarddata-prepper2.16.0-r2
chainguarddruid37.0.0-r56
chainguardjenkins-22.560-r0
chainguardjenkins-2.5552.555.2-r3
chainguardkafka-4.14.1.2-r2
chainguardkafka-4.24.2.0-r5
chainguardkafka-fips-4.14.1.2-r2
chainguardkafka-fips-4.24.2.1-r0
chainguardneo4j-5.265.26.25-r1
chainguardpinot1.5.1-r0
chainguardpinot-fips1.5.1-r0
chainguardreposilite3.6.1-r0
chainguardsolr-1010.0.0-r1
chainguardspark-fips-4.14.1.2-r10
chainguardspark-kubernetes-operator0.9.0-r0
chainguardspark-kubernetes-operator-fips0.9.0-r0
chainguardstrimzi-kafka-operator1.0.0-r8
chainguardstrimzi-kafka-operator-fips1.1.0-r5
chainguardtrino483-r7
chainguardwso2is7.3.0-r0
chainguardzaproxy2.17.0-r12
debian 11jetty9düzeltme belirtilmemiş
debian 12jetty9düzeltme belirtilmemiş
debian 13jetty12düzeltme belirtilmemiş
debian 13jetty9düzeltme belirtilmemiş
debian 14jetty1212.0.33-1
debian 14jetty9düzeltme belirtilmemiş
echoairbyte-source-postgres3.8.8+e2
echojetty12düzeltme belirtilmemiş
echojetty9düzeltme belirtilmemiş
echo maven::Echo OSVorg.eclipse.jetty:jetty-http10.0.26+echo.1
maven::GitHub Security Advisory Mavenorg.eclipse.jetty:jetty-http12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60
minimosapache-nifi2.9.0-r0
minimosapache-nifi-registry2.9.0-r0
minimoscassandra-reaper5.0.0-r0
minimoscloudwatch-exporter0.17.0-r0
minimosjenkins2.556-r0
minimosjenkins-2.5552.555.2-r0
minimosjetty-12.012.0.33-r0
minimosjetty-12.0-fips12.0.33-r0
minimosjetty-12.112.1.7-r0
minimosjetty-12.1-fips12.1.7-r0
minimosjetty-9.49.4.58-r1
minimoskafka-3.93.9.2-r5
minimoskafka-4.24.2.1-r0
minimoskafka-4.2-fips4.2.1-r0
minimosneo4j-2026.022026.02.3-r0
minimosneo4j-5.265.26.23-r0
minimosstrimzi-kafka-operator1.0.1-r4
minimosstrimzi-kafka-operator-0.450.45.2-r11
minimosstrimzi-kafka-operator-0.500.50.1-r4
minimosstrimzi-kafka-operator-fips0.51.0-r1
minimosstrimzi-kafka-operator-fips-0.500.50.1-r1
minimostrino481-r4
minimostrino-fips481-r4
Oracle Linux 9jmc8.2.0-19.el9_8.2
rapidfort debian 12jetty120:12.0.33-1
rapidfort debian 12jetty9düzeltme belirtilmemiş
rapidfort debian 13jetty120:12.0.33-1
rapidfort debian 13jetty9düzeltme belirtilmemiş
rapidfort fedora 43jetty9.4.40-18.fc43
rapidfort fedora 43jetty-client9.4.40-18.fc43
rapidfort fedora 43jetty-continuation9.4.40-18.fc43
rapidfort fedora 43jetty-http9.4.40-18.fc43
rapidfort fedora 43jetty-io9.4.40-18.fc43
rapidfort fedora 43jetty-jaas9.4.40-18.fc43
rapidfort fedora 43jetty-javadoc9.4.40-18.fc43
rapidfort fedora 43jetty-jmx9.4.40-18.fc43
rapidfort fedora 43jetty-security9.4.40-18.fc43
rapidfort fedora 43jetty-server9.4.40-18.fc43
rapidfort fedora 43jetty-servlet9.4.40-18.fc43
rapidfort fedora 43jetty-util9.4.40-18.fc43
rapidfort fedora 43jetty-util-ajax9.4.40-18.fc43
rapidfort fedora 43jetty-webapp9.4.40-18.fc43
rapidfort fedora 43jetty-xml9.4.40-18.fc43
Red Hatjetty-httpdüzeltme belirtilmemiş
Red Hatpuppetserverdüzeltme belirtilmemiş
Red Hatsatellite-capsule:el8::puppetserverdüzeltme belirtilmemiş
seal maven::Seal Security Databaseorg.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999, 3.4.2+sp999, 3.4.3+sp2
seal maven::Seal Security Databaseorg.apache.spark:spark-core_2.112.4.8+sp999
seal maven::Seal Security Databaseorg.apache.spark:spark-core_2.134.0.1+sp999
seal maven::Seal Security Databaseorg.eclipse.jetty:jetty-http10.0.19+sp999, 10.0.22+sp999, 10.0.26+sp2, 11.0.23+sp999, 11.0.24+sp2, 9.4.51.v20230217+sp2, 9.4.53.v20231009+sp999, 9.4.56.v20240826+sp999
seal maven::Seal Security Databaseseal.sp1.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999, 3.4.2+sp999, 3.4.3+sp999
seal maven::Seal Security Databaseseal.sp1.org.apache.spark:spark-core_2.112.4.8+sp999
seal maven::Seal Security Databaseseal.sp1.org.apache.spark:spark-core_2.134.0.1+sp999
seal maven::Seal Security Databaseseal.sp1.org.eclipse.jetty:jetty-http10.0.19+sp999, 10.0.22+sp999, 10.0.26+sp999, 11.0.23+sp999, 11.0.24+sp999, 9.4.51.v20230217+sp999, 9.4.53.v20231009+sp999, 9.4.56.v20240826+sp999
seal maven::Seal Security Databaseseal.sp2.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999, 3.4.2+sp999
seal maven::Seal Security Databaseseal.sp2.org.apache.spark:spark-core_2.112.4.8+sp999
seal maven::Seal Security Databaseseal.sp2.org.eclipse.jetty:jetty-http9.4.53.v20231009+sp999, 9.4.56.v20240826+sp999
seal maven::Seal Security Databaseseal.sp3.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999
seal maven::Seal Security Databaseseal.sp4.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999
seal maven::Seal Security Databaseseal.sp5.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999
seal maven::Seal Security Databaseseal.sp6.org.apache.hadoop:hadoop-client-runtime3.4.1+sp999
seal Red Hat 8libsolv0.7.20-6.el8+sp999
seal Red Hat 8seal-libsolv0.7.20-6.el8+sp999
wolfiakhq0.27.0-r2
wolfiapache-nifi2.9.0-r0
wolfiapache-pulsar-4.24.2.1-r0
wolfiapache-tika-3.13.1.0-r38
wolfiapache-tika-3.23.2.3-r18
wolfiapache-tika-3.33.3.2-r2
wolficassandra-reaper5.0.0-r0
wolficloudwatch-exporter0.18.0-r5
wolfidruid37.0.0-r56
wolfijenkins-22.560-r0
wolfikafka-4.14.1.2-r2
wolfikafka-4.24.2.0-r5
wolfisolr-1010.0.0-r1
wolfistrimzi-kafka-operator1.0.0-r8
wolfitrino483-r7

Referanslar

37 referansın hepsi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.