Request Smuggling Vulnerability in Eclipse Jetty HTTP/1.1 Parser

CVE-2026-2332

What is CVE-2026-2332?

Eclipse Jetty's HTTP/1.1 parser is susceptible to a request smuggling attack when chunk extensions are utilized. The vulnerability arises due to improper termination of chunk extension parsing within quoted strings, leading to potential injection of smuggled requests. This flaw allows attackers to exploit the parsing mechanism, effectively bypassing security measures, which can pose significant risks to server integrity and data security. Active exploitation scenarios may include injecting unauthorized requests to sensitive endpoints, potentially allowing for further attacks or data exfiltration.

References