CVE-2026-2332: Jetty HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Summary
CVE-2026-2332: Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing. Affects org.eclipse.jetty:jetty-http across 5 version ranges.
>= 9.4.0, < 9.4.60
>= 10.0.0, < 10.0.28
>= 11.0.0, < 11.0.28
>= 12.0.0, < 12.0.33
>= 12.1.0, < 12.1.7
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jetty is a widely-used Java-based web server and servlet container that provides a robust environment for running web applications. It supports HTTP/1.1 and various features such as asynchronous processing and WebSocket support. However, a recent vulnerability has been identified in its handling of HTTP chunked transfer encoding, specifically in the parsing of quoted strings within chunk extensions, which can lead to serious security issues.
Vulnerability Detail
The vulnerability arises from Jetty's incorrect parsing of quoted strings in HTTP/1.1 chunked transfer encoding extension values. This flaw allows attackers to exploit request smuggling techniques, enabling them to inject arbitrary HTTP requests, poison shared caches, bypass access controls, and potentially hijack user sessions. The issue was discovered during research into 'Funky Chunks' HTTP request smuggling techniques, revealing that Jetty terminates chunk header parsing at CRLF sequences inside quoted strings instead of treating them as parsing errors, which is contrary to the specifications outlined in RFC 9112.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.4.0, < 9.4.609.4.60 -
>= 10.0.0, < 10.0.2810.0.28 -
>= 11.0.0, < 11.0.2811.0.28 -
>= 12.0.0, < 12.0.3312.0.33 -
>= 12.1.0, < 12.1.712.1.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. It is strongly advised to apply the necessary updates as soon as possible to mitigate the risk.
Conclusion
In summary, CVE-2026-2332 is a significant vulnerability in Jetty that can lead to serious security risks such as request smuggling and session hijacking. It is crucial for users to update to the patched versions of the Jetty HTTP package to safeguard their applications against potential attacks.
See every vulnerability recorded for org.eclipse.jetty:jetty-http →
FAQ
CVE-2026-2332 is a vulnerability in Jetty that allows for HTTP request smuggling via improper parsing of quoted strings in chunked transfer encoding.
The impacts include request smuggling, cache poisoning, access control bypass, and session hijacking.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. You can also check your application using the Vulert playground without any signup.
Affected versions include Jetty 9.4.59 and earlier, 10.0.27 and earlier, 11.0.27 and earlier, 12.0.32 and earlier, and 12.1.6 and earlier.
The CVSS score for this vulnerability is 7.4, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-http.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
