Executive brief
Eclipse Jetty is a widely-used Java web server and HTTP client library. A flaw in its HTTP/1.1 chunked request parsing allows attackers to craft malicious requests that Jetty and upstream proxies interpret differently, enabling request smuggling attacks. An attacker can exploit this to bypass security controls, poison caches, or hijack user sessions when Jetty is deployed behind an intermediary proxy.
Technical details
The vulnerability is an HTTP request smuggling flaw (CWE-444) in Jetty's chunked transfer encoding parser. Jetty incorrectly accepts a lone LF (line feed, \n) character as a chunk terminator in chunk extensions, chunk data, or trailers—depending on the version and configured HTTP compliance mode. RFC 9110 (Jetty 12.1.0+, default) rejects this; older versions and RFC 7230/RFC 2616 modes allow it. An unauthenticated remote attacker can send a specially crafted POST request with Transfer-Encoding: chunked, exploiting the LF handling to inject a hidden HTTP request. The attack is network-reachable, requires no authentication, and succeeds when Jetty sits behind a proxy that enforces stricter RFC 9110 parsing. Patches are available: 12.1.12, 12.0.38, 11.0.32, 10.0.32, and 9.4.64. Users can mitigate by ensuring RFC 9110 compliance mode is enforced (or upgrading to 12.1.0+) and disabling legacy compliance modes if operationally feasible.
Affected products
- Eclipse Jetty 9.4.0–9.4.63, 10.0.0–10.0.31, 11.0.0–11.0.31, 12.0.0–12.0.37, 12.1.0–12.1.11
Timeline
- 2026-09-17: disclosed: GHSA-xc35-c22g-239h published
- 2026-09-17: patched: Patches released: 12.1.12, 12.0.38, 11.0.32, 10.0.32, 9.4.64