Junglewise Threat Intelligence

CVE-2026-2332: Eclipse Jetty HTTP request smuggling in chunk extension parsing

CVE-2026-2332 · Severity: high · CVSS 7.4 · Published 2026-04-14

Technologies: Eclipse Foundation Jetty. Vendors: Eclipse Foundation, Eclipse.

Executive brief

Eclipse Jetty, a widely used web server and servlet engine, contains a vulnerability in how it handles specific types of web traffic. An attacker can send specially crafted requests that trick the server into misinterpreting where one request ends and the next begins. This can allow an attacker to bypass security controls, hijack user sessions, or poison web caches, potentially leading to unauthorized access to sensitive data.

Technical details

Eclipse Jetty's HTTP/1.1 parser incorrectly handles CRLF sequences within quoted strings in chunk extensions. According to RFC 9110 and 9112, CRLF is not permitted within these quotes and should result in a parsing error. Instead, Jetty terminates the chunk header parsing at the CRLF, allowing an attacker to inject a smuggled HTTP request into the remaining data. This vulnerability is a variant of 'funky chunks' techniques. Exploitation requires a network-based attacker to send a malformed chunked request; success can lead to cache poisoning, security filter bypass, or session hijacking. Patches are available in versions 9.4.60, 10.0.28, 11.0.28, 12.0.33, and 12.1.7.

Affected products

  • Eclipse Jetty >=9.4.0, <=9.4.59; >=10.0.0, <=10.0.27; >=11.0.0, <=11.0.27; >=12.0.0, <=12.0.32; >=12.1.0, <=12.1.6

Timeline

  • 2026-04-14: advisory: Initial disclosure and GHSA publication
  • 2026-04-14: disclosed

References

Related threats