Skip to content
Fencer Vulns
high 7.4

CVE-2026-2332 json

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

published 2026-04-14 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-22243 , GHSA-355h-qmc2-wpwf

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits
0
none known

Summary

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html

* https://w4ke.info/2025/10/29/funky-chunks-2.html

Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error.

POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked

1;ext="val X 0

GET /smuggled HTTP/1.1 ...

Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

Patch / fix

  • maven org.eclipse.jetty:jetty-http 9.4.60, 10.0.28, 11.0.29, 12.0.33, 12.1.7
  • Red Hat Red Hat Enterprise Linux 9 0:8.2.0-19.el9_8.2
  • Red Hat Red Hat Satellite 6.16 for RHEL 8 0:8.14.1-1.el8sat
  • Red Hat Red Hat Satellite 6.16 for RHEL 9 0:8.14.1-1.el9sat
  • Red Hat Red Hat Satellite 6.17 for RHEL 9 0:8.14.1-1.el9sat
  • Red Hat Red Hat Satellite 6.18 for RHEL 9 0:8.14.1-1.el9sat
  • Red Hat Red Hat Satellite 6.19 for RHEL 9 0:8.14.1-1.el9sat
  • Red Hat OpenShift Developer Tools and Services 4.12 1786628667
  • Red Hat OpenShift Developer Tools and Services 4.13 1786628681
  • Red Hat OpenShift Developer Tools and Services 4.14 1786533561
  • Red Hat OpenShift Developer Tools and Services 4.15 1786533565
  • Red Hat OpenShift Developer Tools and Services 4.16 1787125166
  • Red Hat OpenShift Developer Tools and Services 4.17 1787124635
  • Red Hat OpenShift Developer Tools and Services 4.18 1787125069
  • Red Hat OpenShift Developer Tools and Services 4.19 1787124632
  • Red Hat OpenShift Developer Tools and Services 4.20 1787124925
  • Red Hat OpenShift Developer Tools and Services 4.21 1787125311
  • Red Hat OpenShift Developer Tools and Services 4.22 1787124779
  • Red Hat Red Hat Offline Knowledge Portal 1.2.12 1779996999
  • Red Hat Red Hat OpenShift Dev Spaces 3.27 1776716842, 1776717247
  • jetty12 Debian 14 12.0.33-1

debian advisories DEBIAN-CVE-2026-2332

  • openvox-agent satellite capsule 6.18, satellite capsule 6.17, satellite capsule 6.16 +3 more 8.24.1-3.el9sat
  • openvox-server satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +5 more 8.14.1-1.el9sat
  • rubygem-faraday satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +5 more 1.10.6-1.el9sat
  • rubygem-katello satellite 6.18 4.18.0.15-1.el9sat
  • python3.12-pyjwt satellite capsule 6.18, satellite 6.18 2.13.0-1.el9pc
  • rubygem-nokogiri satellite capsule 6.18, satellite capsule 6.17, satellite 6.18 +1 more 1.15.7-3.el9sat
  • python3.12-pillow satellite capsule 6.19, satellite capsule 6.18, satellite 6.19 +1 more 12.3.0-1.el9pc
  • python3.12-pyjwt+crypto satellite capsule 6.18, satellite 6.18 2.13.0-1.el9pc

red hat advisories RHSA-2026:50263RHSA-2026:50222RHSA-2026:50223RHSA-2026:50221RHSA-2026:20568

  • jetty-minimal openSUSE Tumbleweed 9.4.58-4.1

opensuse advisories openSUSE-SU-2026:10574-1

  • jmc AlmaLinux 9 8.2.0-19.el9_8.2

almalinux advisories ALSA-2026:20568

  • jmc Rocky Linux 9 8.2.0-19.el9_8.2

rocky linux advisories RLSA-2026:20568

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-2332 updated cvss 7.4

org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing

  • Red Hat OpenShift Developer Tools and Services jenkins Red Hat build of Apache Camel 4 for Quarkus 3 jetty-http
    affected: workaround, no fix available “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat build of Debezium 2 jetty-http Red Hat build of Debezium 3 jetty-http Red Hat Fuse 7 jetty-http Red Hat JBoss Web Server 6 jetty-http
    affected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat Satellite 6 puppetserver
    affected: workaround, no fix available “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat Single Sign-On 7 jetty-http Red Hat streams for Apache Kafka 2 jetty-http Red Hat streams for Apache Kafka 3 jetty-http
    affected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat HawtIO HawtIO 4.4.0
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:25089
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-rhel8 1786628667
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:60247
  • Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-rhel8 1786628681
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:60249
  • Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-rhel8 1786533561
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:60248
show 19 more
  • Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-rhel8 1786533565
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:60239
  • Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-rhel9 1787125166
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:60251
  • Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-rhel9 1787124635
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:60246
  • Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-rhel9 1787125069
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:60250
  • Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-rhel9 1787124632
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:60252
  • Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-rhel9 1787124925
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:60259
  • Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-rhel9 1787125311
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:60254
  • Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-rhel9 1787124779
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:60256
  • Red Hat AMQ Broker 7.13.5
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:14272
  • Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:22453
  • Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:17668
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) jmc 8.2.0-19.el9_8.2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:20568
  • Red Hat Offline Knowledge Portal 1.2.13 offline-knowledge-portal/rhokp-rhel9 1779996999
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:21773
  • Red Hat OpenShift Dev Spaces 3.27 devspaces 1776716842, devspaces 1776717247
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:10175
  • Red Hat Satellite 6.16 for RHEL 8 openvox-server 8.14.1-1.el8sat Red Hat Satellite 6.16 for RHEL 9 openvox-server 8.14.1-1.el9sat
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:50223
  • Red Hat Satellite 6.17 for RHEL 9 openvox-server 8.14.1-1.el9sat
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:50222
  • Red Hat Satellite 6.18 for RHEL 9 openvox-server 8.14.1-1.el9sat
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:50263
  • Red Hat Satellite 6.19 for RHEL 9 openvox-server 8.14.1-1.el9sat
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:50221
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-agent-base-rhel8 1786628706 Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-agent-base-rhel8 1786628711 Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-agent-base-rhel8 1786628748 Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-agent-base-rhel8 1786628726 Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-agent-base-rhel9 1787124634 Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-agent-base-rhel9 1787124986
    +1 more products
    Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-agent-base-rhel9 1787124633
    not affected: vulnerable code not present

17 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
6 mo ago

Exploit prediction

1.31% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADP 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.eclipse.jetty:jetty-http
>=12.1.0, <12.1.7
>=12.0.0, <12.0.33
>=11.0.0, <11.0.29
>=10.0.0, <10.0.28
>=9.4.0, <9.4.60
12.1.7
12.0.33
11.0.29
10.0.28
9.4.60

Affected products

  • Eclipse Foundation Eclipse Jetty
  • Red Hat HawtIO HawtIO 4.4.0
  • Red Hat Red Hat AMQ Broker 7.13.5
  • Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
  • Red Hat Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Red Hat Satellite 6.19 for RHEL 9
  • Red Hat OpenShift Developer Tools and Services 4.12
  • Red Hat OpenShift Developer Tools and Services 4.13
  • Red Hat OpenShift Developer Tools and Services 4.14
  • Red Hat OpenShift Developer Tools and Services 4.15
  • Red Hat OpenShift Developer Tools and Services 4.16
  • Red Hat OpenShift Developer Tools and Services 4.17
  • Red Hat OpenShift Developer Tools and Services 4.18
  • Red Hat OpenShift Developer Tools and Services 4.19
  • Red Hat OpenShift Developer Tools and Services 4.20
  • Red Hat OpenShift Developer Tools and Services 4.21
  • Red Hat OpenShift Developer Tools and Services 4.22
  • Red Hat Red Hat Offline Knowledge Portal 1.2.12
  • Red Hat Red Hat OpenShift Dev Spaces 3.27
  • Red Hat OpenShift Developer Tools and Services
  • Red Hat Red Hat AMQ Broker 7
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apicurio Registry 2
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 2
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat JBoss Web Server 6
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat streams for Apache Kafka 2
  • Red Hat streams for Apache Kafka 3

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.