9.1

CVE-2026-2332: eclipse foundation eclipse jetty HTTP Request/Response Smuggling

CVSS: 9.1v3.1CriticalModified
AliasesUBUNTU-CVE-2026-2332DEBIAN-CVE-2026-2332CGA-2jm2-mwhr-87cg
Published 14-04-2026Last modified 14-09-2026
Open JSON

Vulnerability summary

CVE-2026-2332 is a critical (CVSS 9.1) HTTP Request/Response Smuggling vulnerability in eclipse foundation eclipse jetty. EPSS estimates a 1.31% chance of exploitation in the next 30 days, higher than 70% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.1/10
010
Critical · v3.1 (NVD)
EPSS score
1.31%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 6 · Related 2
OPENSUSE-SU-2026:10574-1RHSA-2026:20568RHSA-2026:50221RHSA-2026:50222RHSA-2026:50223RHSA-2026:50263

Timeline

  1. 14-04-2026
    PublishedVulnerability first disclosed.
  2. 14-09-2026
    Last modifiedVulnerability information updated.

Description

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

1.31%

Chance of exploitation in the next 30 days

Percentile

70%

Versus all other CVEs

30-day change

0.00 pp

From 1.31% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.31%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Jetty.Project

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard133 products
  • akhq< 0.27.0-r2
  • apache-activemq-5.19All versions (No fix recorded)
  • apache-activemq-6.1All versions (No fix recorded)
  • apache-activemq-6.2All versions (No fix recorded)
  • apache-activemq-fips-5.19All versions (No fix recorded)
Wolfi38 products
  • akhq< 0.27.0-r2
  • apache-nifi< 2.9.0-r0
  • apache-nifi-toolkit< 2.9.0-r0
  • apache-pulsar-4.1All versions (No fix recorded)
  • apache-pulsar-4.2< 4.2.1-r0
Debian2 products
  • jetty12All versions (No fix recorded) | < 12.0.33-1
  • jetty9All versions (No fix recorded)
Ubuntu2 products
  • jetty12All versions (No fix recorded)
  • jetty9All versions (No fix recorded)
Eclipse1 product
  • jetty≥ 9.4.0, < 9.4.60 | ≥ 10.0.0, < 10.0.28 | ≥ 11.0.0, < 11.0.28 | ≥ 12.0.0, < 12.0.33 | ≥ 12.1.0, < 12.1.7
Eclipse foundation1 product
  • eclipse jetty≥ 12.1.0, ≤ 12.1.6 | ≥ 12.0.0, ≤ 12.0.32 | ≥ 11.0.0, ≤ 11.0.28 | ≥ 10.0.0, ≤ 10.0.27 | ≥ 9.4.0, ≤ 9.4.59
Org.eclipse.jetty1 product
  • jetty-http≥ 12.1.0, < 12.1.7 | ≥ 12.0.0, < 12.0.33 | ≥ 11.0.0, < 11.0.29 | ≥ 10.0.0, < 10.0.28 | ≥ 9.4.0, < 9.4.60

7 vendors · 178 products

References

35 links
Show all 35 references