CVE-2026-2332

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-2332
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-2332.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-2332
Aliases
Downstream
ALSA (1)
CGA (400)
CLEANSTART (42)
CLSA (4)
DEBIAN (1)
ECHO (1)
MINI (77)
openSUSE (1)
RHLW (2)
RHSA (5)
RLSA (1)
ROOT (1)
SUSE (1)
UBUNTU (1)
Related
Published
2026-04-14T10:59:10Z
Modified
2026-11-06T02:47:09Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Details

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here:

Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error.

POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked

1;ext="val X 0

GET /smuggled HTTP/1.1 ...

Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

Database specific 
{
    "cna_assigner": "eclipse",
    "cwe_ids": [
        "CWE-444"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2332.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "12.1.0"
                        },
                        {
                            "last_affected": "12.1.6"
                        },
                        {
                            "introduced": "12.0.0"
                        },
                        {
                            "last_affected": "12.0.32"
                        },
                        {
                            "introduced": "11.0.0"
                        },
                        {
                            "last_affected": "11.0.28"
                        },
                        {
                            "introduced": "10.0.0"
                        },
                        {
                            "last_affected": "10.0.27"
                        },
                        {
                            "introduced": "9.4.0"
                        },
                        {
                            "last_affected": "9.4.59"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/jetty/jetty.project

Affected ranges

Type
GIT
Repo
https://github.com/jetty/jetty.project
Events
Introduced
28100e8da711e44c0722ed10bd413ae862497539
Fixed
1bd927df90579c8e6420c8d59c4cdb152c4ae0c0
Introduced
c8372b65bd15404de1444d68902c0455a3a69b64
Fixed
8e2e9db9edceef93d37a63814ed06b921eb7f23d
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "12.0.0"
                },
                {
                    "fixed": "12.0.33"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "12.1.0"
                },
                {
                    "fixed": "12.1.7"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

jetty-12.*
jetty-12.0.0x
jetty-12.0.14
jetty-12.0.15
jetty-12.0.19
jetty-12.0.22
jetty-12.0.23
jetty-12.0.30
jetty-12.0.31
jetty-12.0.5
jetty-12.0.6
jetty-12.1.0.beta1
jetty-12.1.2
jetty-12.1.4
jetty-12.1.5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-2332.json"