SB2026041433 - HTTP request smuggling in Eclipse Jetty
Published: April 14, 2026
Security Bulletin ID
SB2026041433
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-2332)
The vulnerability allows a remote attacker to inject arbitrary HTTP requests.
The vulnerability exists due to inconsistent interpretation of HTTP requests in the chunked transfer encoding extension parser when parsing quoted strings in HTTP/1.1 chunked transfer encoding extension values. A remote attacker can send a specially crafted chunked HTTP request to inject arbitrary HTTP requests.
The issue occurs because CRLF sequences inside quoted strings are treated as chunk header terminators instead of parsing errors.
Remediation
Install update from vendor's website.