CVE-2026-2332: Eclipse Jetty HTTP request smuggling in chunk extension parsing

CVE-2026-2332 · Severity: high · CVSS 7.4 · Published 2026-04-14

Eclipse Jetty, a widely used web server and servlet engine, contains a vulnerability in how it handles specific types of web traffic. An attacker can send specially crafted requests that trick the server into misinterpreting where one request ends and the next begins. This can allow an attacker to bypass security controls, hijack user sessions, or poison web caches, potentially leading to unauthorized access to sensitive data.

Technologies: Eclipse Foundation Jetty, org.eclipse.jetty:jetty-http (Maven). Vendors: Eclipse Foundation, Maven.

Quick answers

Is CVE-2026-2332 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-2332 being exploited in the wild.
How severe is CVE-2026-2332?
High severity, with a CVSS score of 7.4, published 14 April 2026.
Which products and versions are affected?
Eclipse Foundation Jetty >= 12.1.0, <= 12.1.6; >= 12.0.0, <= 12.0.32; >= 11.0.0, <= 11.0.27; >= 10.0.0, <= 10.0.27; >= 9.4.0, <= 9.4.59, >=9.4.0, <=9.4.59; >=10.0.0, <=10.0.27; >=11.0.0, <=11.0.27; >=12.0.0, <=12.0.32; >=12.1.0, <=12.1.6; org.eclipse.jetty:jetty-http (Maven) ECOSYSTEM:introduced=12.1.0,fixed=12.1.7.
Is there a fix for CVE-2026-2332?
Yes. org.eclipse.jetty:jetty-http (Maven): upgrade to 12.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2332 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-2332?
Check whether you run Eclipse Foundation Jetty or org.eclipse.jetty:jetty-http (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.eclipse.jetty:jetty-http (Maven): upgrade to 12.1.7 or later
    # set org.eclipse.jetty:jetty-http to 12.1.7 in your pom.xml or build.gradle

Technical details

Eclipse Jetty's HTTP/1.1 parser incorrectly handles CRLF sequences within quoted strings in chunk extensions. According to RFC 9110 and 9112, CRLF is not permitted within these quotes and should result in a parsing error. Instead, Jetty terminates the chunk header parsing at the CRLF, allowing an attacker to inject a smuggled HTTP request into the remaining data. This vulnerability is a variant of 'funky chunks' techniques. Exploitation requires a network-based attacker to send a malformed chunked request; success can lead to cache poisoning, security filter bypass, or session hijacking. Patches are available in versions 9.4.60, 10.0.28, 11.0.28, 12.0.33, and 12.1.7.

Affected products

  • Eclipse Jetty >=9.4.0, <=9.4.59; >=10.0.0, <=10.0.27; >=11.0.0, <=11.0.27; >=12.0.0, <=12.0.32; >=12.1.0, <=12.1.6

Identifiers

  • CVE-2026-2332
  • GHSA-355h-qmc2-wpwf

Timeline

  • 2026-04-14: advisory: Initial disclosure and GHSA publication
  • 2026-04-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.