Critical severity · published Apr 14, 2026
CVE-2026-2332
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
9.1
CVSS
1.3%
EPSS
No
On KEV
Description
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here:
* https://w4ke.info/2025/06/18/funky-chunks.html
* https://w4ke.info/2025/10/29/funky-chunks-2.html
Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error.
POST / HTTP/1.1
Host: localhost
Transfer-Encoding: chunked
1;ext="val
X
0
GET /smuggled HTTP/1.1
...
Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EJ
Eclipse Jetty · Eclipse Foundation
12.1.0 through 12.1.6; 12.0.0 through 12.0.32; 11.0.0 through 11.0.28; 10.0.0 through 10.0.27; 9.4.0 through 9.4.59 · source: vendor
JE
Jetty · Eclipse
9.4.0 before 9.4.60; 10.0.0 before 10.0.28; 11.0.0 before 11.0.28; 12.0.0 before 12.0.33; 12.1.0 before 12.1.7 · source: NVD
OD
OpenShift Developer Tools and Services · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.12 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.13 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.14 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.15 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.16 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.17 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.18 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.19 · Red Hat
All versions, or not specified · source: CISA
OD
OpenShift Developer Tools and Services 4.20 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2332
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2332
Exploit
https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf
Issue Tracking
https://gitlab.eclipse.org/security/cve-assignment/-/issues/89
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:10175
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:14272
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:17668
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:20568
More from Eclipse Jetty
9.1
CVE-2026-10050
Digest authentication lossy encoding
8.7
CVE-2026-12611
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to…
8.7
CVE-2026-19204
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the…
8.3
CVE-2026-19203
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially…
8.2
CVE-2026-77711
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required)