HTTP Request Smuggling in Jetty Server by Eclipse Foundation
CVE-2026-19203

8.3HIGH

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Jetty
Vendor
CVE Published:
8 September 2026

What is CVE-2026-19203?

The Jetty server, developed by the Eclipse Foundation, has a vulnerability that can be exploited through the sending of specially crafted HTTP/1.1 chunked requests. This flaw enables attackers to manipulate how different components, including Jetty and any intermediary proxies, interpret request boundaries. By accepting a standalone LF character as a terminator during chunked request parsing, Jetty may process chunk extensions, data terminations, or trailer terminations inconsistently. This inconsistency creates the potential for HTTP request smuggling, allowing attackers to bypass security controls and perform unauthorized actions.

Affected Version(s)

Eclipse Jetty 12.1.0 <= 12.1.11

Eclipse Jetty 12.0.0 <= 12.0.37

Eclipse Jetty 11.0.0 <= 11.0.31

References

https://github.com/jetty/jetty.project/security/advisorie...

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/yarocher
.