CVE-2026-2332
- Source
- https://cve.org/CVERecord?id=CVE-2026-2332
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-2332.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-2332
- Aliases
- Downstream
- Related
- Published
- 2026-04-14T10:59:10.193Z
- Modified
- 2026-05-28T03:52:47.092885447Z
- Severity
-
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
- Details
-
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html
- https://w4ke.info/2025/10/29/funky-chunks-2.html
Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error.
POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked
1;ext="val X 0
GET /smuggled HTTP/1.1 ...
Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2332.json", "cwe_ids": [ "CWE-444" ], "cna_assigner": "eclipse", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "11.0.0" }, { "last_affected": "11.0.27" }, { "introduced": "10.0.0" }, { "last_affected": "10.0.27" }, { "introduced": "9.4.0" }, { "last_affected": "9.4.59" } ], "source": "AFFECTED_FIELD" } ] }- References
-
- https://repo.maven.apache.org/maven2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2332.json
- https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf
- https://nvd.nist.gov/vuln/detail/CVE-2026-2332
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/89
- https://github.com/jetty/jetty.project