Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-2332

critical

CVE-2026-2332

org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing

Published Modified CWE 444
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (high), AlmaLinux (high), Oracle (high).

Description

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

Affected packages and fixed versions

SourcePackageFixed in
alma 9jmc8.2.0-19.el9_8.2
chainguardakhq, apache-hop, apache-hop-fips and 43 more0.27.0-r2 and 37 more
debian 11jetty9no fix listed
debian 12jetty9no fix listed
debian 13jetty12, jetty9no fix listed
debian 14jetty12, jetty912.0.33-1
echoairbyte-source-postgres, jetty12, jetty93.8.8+e2
echo maven::Echo OSVorg.eclipse.jetty:jetty-http10.0.26+echo.1
maven::GitHub Security Advisory Mavenorg.eclipse.jetty:jetty-http12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60
minimosapache-nifi, apache-nifi-registry, cassandra-reaper and 20 more2.9.0-r0 and 17 more
Oracle Linux 9jmc8.2.0-19.el9_8.2
rapidfort debian 12jetty12, jetty90:12.0.33-1
Show all 136 entries from 18 sources
SourcePackageFixed in
alma 9jmc8.2.0-19.el9_8.2
chainguardakhq0.27.0-r2
chainguardapache-hop2.18.0-r0
chainguardapache-hop-fips2.18.0-r0
chainguardapache-jena-fuseki6.0.0-r5
chainguardapache-nifi2.9.0-r0
chainguardapache-pulsar-4.04.0.10-r0
chainguardapache-pulsar-4.24.2.1-r0
chainguardapache-pulsar-fips-4.04.0.10-r0
chainguardapache-pulsar-fips-4.24.2.1-r0
chainguardapache-tika-3.03.0.0-r31
chainguardapache-tika-3.13.1.0-r38
chainguardapache-tika-3.23.2.3-r18
chainguardapache-tika-3.33.3.2-r2
chainguardapache-tika-fips-3.03.0.0-r13
chainguardapache-tika-fips-3.13.1.0-r15
chainguardapache-tika-fips-3.23.2.3-r13
chainguardapache-tika-fips-3.33.3.2-r4
chainguardautomq1.7.4-r1
chainguardautomq-fips1.7.4-r1
chainguardcassandra-reaper5.0.0-r0
chainguardceleborn-0.50.5.4-r26
chainguardclojure-tools1.12.5.1654-r0
chainguardcloudwatch-exporter0.18.0-r5
chainguardcruise-control2.5.146-r1
chainguardcruise-control-fips2.5.146-r2
chainguarddata-prepper2.16.0-r2
chainguarddruid37.0.0-r56
chainguardjenkins-22.560-r0
chainguardjenkins-2.5552.555.2-r3
chainguardkafka-4.14.1.2-r2
chainguardkafka-4.24.2.0-r5
chainguardkafka-fips-4.14.1.2-r2
chainguardkafka-fips-4.24.2.1-r0
chainguardneo4j-5.265.26.25-r1
chainguardpinot1.5.1-r0
chainguardpinot-fips1.5.1-r0
chainguardreposilite3.6.1-r0
chainguardsolr-1010.0.0-r1
chainguardspark-fips-4.14.1.2-r10
chainguardspark-kubernetes-operator0.9.0-r0
chainguardspark-kubernetes-operator-fips0.9.0-r0
chainguardstrimzi-kafka-operator1.0.0-r8
chainguardstrimzi-kafka-operator-fips1.1.0-r5
chainguardtrino483-r7
chainguardwso2is7.3.0-r0
chainguardzaproxy2.17.0-r12
debian 11jetty9no fix listed
debian 12jetty9no fix listed
debian 13jetty12no fix listed
debian 13jetty9no fix listed
debian 14jetty1212.0.33-1
debian 14jetty9no fix listed
echoairbyte-source-postgres3.8.8+e2
echojetty12no fix listed
echojetty9no fix listed
echo maven::Echo OSVorg.eclipse.jetty:jetty-http10.0.26+echo.1
maven::GitHub Security Advisory Mavenorg.eclipse.jetty:jetty-http12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60
minimosapache-nifi2.9.0-r0
minimosapache-nifi-registry2.9.0-r0
minimoscassandra-reaper5.0.0-r0
minimoscloudwatch-exporter0.17.0-r0
minimosjenkins2.556-r0
minimosjenkins-2.5552.555.2-r0
minimosjetty-12.012.0.33-r0
minimosjetty-12.0-fips12.0.33-r0
minimosjetty-12.112.1.7-r0
minimosjetty-12.1-fips12.1.7-r0
minimosjetty-9.49.4.58-r1
minimoskafka-3.93.9.2-r5
minimoskafka-4.24.2.1-r0
minimoskafka-4.2-fips4.2.1-r0
minimosneo4j-2026.022026.02.3-r0
minimosneo4j-5.265.26.23-r0
minimosstrimzi-kafka-operator1.0.1-r4
minimosstrimzi-kafka-operator-0.450.45.2-r11
minimosstrimzi-kafka-operator-0.500.50.1-r4
minimosstrimzi-kafka-operator-fips0.51.0-r1
minimosstrimzi-kafka-operator-fips-0.500.50.1-r1
minimostrino481-r4
minimostrino-fips481-r4
Oracle Linux 9jmc8.2.0-19.el9_8.2
rapidfort debian 12jetty120:12.0.33-1
rapidfort debian 12jetty9no fix listed
rapidfort debian 13jetty120:12.0.33-1
rapidfort debian 13jetty9no fix listed
rapidfort fedora 43jetty9.4.40-18.fc43
rapidfort fedora 43jetty-client9.4.40-18.fc43
rapidfort fedora 43jetty-continuation9.4.40-18.fc43
rapidfort fedora 43jetty-http9.4.40-18.fc43
rapidfort fedora 43jetty-io9.4.40-18.fc43
rapidfort fedora 43jetty-jaas9.4.40-18.fc43
rapidfort fedora 43jetty-javadoc9.4.40-18.fc43
rapidfort fedora 43jetty-jmx9.4.40-18.fc43
rapidfort fedora 43jetty-security9.4.40-18.fc43
rapidfort fedora 43jetty-server9.4.40-18.fc43
rapidfort fedora 43jetty-servlet9.4.40-18.fc43
rapidfort fedora 43jetty-util9.4.40-18.fc43
rapidfort fedora 43jetty-util-ajax9.4.40-18.fc43
rapidfort fedora 43jetty-webapp9.4.40-18.fc43
rapidfort fedora 43jetty-xml9.4.40-18.fc43
Red Hatjetty-httpno fix listed
Red Hatpuppetserverno fix listed
Red Hatsatellite-capsule:el8::puppetserverno fix listed
seal maven::Seal Security Databaseorg.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999, 3.4.2+sp999, 3.4.3+sp2
seal maven::Seal Security Databaseorg.apache.spark:spark-core_2.112.4.8+sp999
seal maven::Seal Security Databaseorg.apache.spark:spark-core_2.134.0.1+sp999
seal maven::Seal Security Databaseorg.eclipse.jetty:jetty-http10.0.19+sp999, 10.0.22+sp999, 10.0.26+sp2, 11.0.23+sp999, 11.0.24+sp2, 9.4.51.v20230217+sp2, 9.4.53.v20231009+sp999, 9.4.56.v20240826+sp999
seal maven::Seal Security Databaseseal.sp1.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999, 3.4.2+sp999, 3.4.3+sp999
seal maven::Seal Security Databaseseal.sp1.org.apache.spark:spark-core_2.112.4.8+sp999
seal maven::Seal Security Databaseseal.sp1.org.apache.spark:spark-core_2.134.0.1+sp999
seal maven::Seal Security Databaseseal.sp1.org.eclipse.jetty:jetty-http10.0.19+sp999, 10.0.22+sp999, 10.0.26+sp999, 11.0.23+sp999, 11.0.24+sp999, 9.4.51.v20230217+sp999, 9.4.53.v20231009+sp999, 9.4.56.v20240826+sp999
seal maven::Seal Security Databaseseal.sp2.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999, 3.4.2+sp999
seal maven::Seal Security Databaseseal.sp2.org.apache.spark:spark-core_2.112.4.8+sp999
seal maven::Seal Security Databaseseal.sp2.org.eclipse.jetty:jetty-http9.4.53.v20231009+sp999, 9.4.56.v20240826+sp999
seal maven::Seal Security Databaseseal.sp3.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999
seal maven::Seal Security Databaseseal.sp4.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999
seal maven::Seal Security Databaseseal.sp5.org.apache.hadoop:hadoop-client-runtime3.4.0+sp999, 3.4.1+sp999
seal maven::Seal Security Databaseseal.sp6.org.apache.hadoop:hadoop-client-runtime3.4.1+sp999
seal Red Hat 8libsolv0.7.20-6.el8+sp999
seal Red Hat 8seal-libsolv0.7.20-6.el8+sp999
wolfiakhq0.27.0-r2
wolfiapache-nifi2.9.0-r0
wolfiapache-pulsar-4.24.2.1-r0
wolfiapache-tika-3.13.1.0-r38
wolfiapache-tika-3.23.2.3-r18
wolfiapache-tika-3.33.3.2-r2
wolficassandra-reaper5.0.0-r0
wolficloudwatch-exporter0.18.0-r5
wolfidruid37.0.0-r56
wolfijenkins-22.560-r0
wolfikafka-4.14.1.2-r2
wolfikafka-4.24.2.0-r5
wolfisolr-1010.0.0-r1
wolfistrimzi-kafka-operator1.0.0-r8
wolfitrino483-r7

References

All 37 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.