CVE-2026-2332
Description
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
How to fix
- eclipse jetty9.4.60, 10.0.28, 11.0.28, 12.0.33, 12.1.7 or later
- org.eclipse.jetty:jetty-http12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60 or later
- access.redhat.com/errata/RHSA-2026:50223
- access.redhat.com/errata/RHSA-2026:50222
- access.redhat.com/errata/RHSA-2026:50263
- access.redhat.com/errata/RHSA-2026:50221
- access.redhat.com/errata/RHSA-2026:20568
- access.redhat.com/errata/RHSA-2026:25089
- access.redhat.com/errata/RHSA-2026:60247
- access.redhat.com/errata/RHSA-2026:60249
- access.redhat.com/errata/RHSA-2026:60248
- access.redhat.com/errata/RHSA-2026:60239
- access.redhat.com/errata/RHSA-2026:60251
- access.redhat.com/errata/RHSA-2026:60246
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse jetty | 9.4.0 ≤ v < 9.4.60, 10.0.0 ≤ v < 10.0.28, 11.0.0 ≤ v < 11.0.28, 12.0.0 ≤ v < 12.0.33, 12.1.0 ≤ v < 12.1.7 | 9.4.60, 10.0.28, 11.0.28, 12.0.33, 12.1.7 |
| org.eclipse.jetty:jetty-httpMaven | 12.1.0 ≤ v < 12.1.7, 12.0.0 ≤ v < 12.0.33, 11.0.0 ≤ v < 11.0.29, 10.0.0 ≤ v < 10.0.28, 9.4.0 ≤ v < 9.4.60 | 12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.