PT-2026-32618 · Eclipse Foundation+1 · Jetty+1

Xclow3N · Published 2026-04-14 · Updated 2026-05-01 · CVE-2026-2332

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 12.1.0 through 12.1.6 Eclipse Jetty versions 12.0.0 through 12.0.32 Eclipse Jetty versions 11.0.0 through 11.0.27 Eclipse Jetty versions 10.0.0 through 10.0.27 Eclipse Jetty versions 9.4.0 through 9.4.59

Description The HTTP/1.1 parser incorrectly handles quoted strings within chunked transfer encoding extension values. Specifically, the parser terminates chunk header parsing when it encounters a carriage return and line feed (CRLF) sequence inside a quoted string instead of treating it as a parsing error. This behavior allows an attacker to inject smuggled HTTP requests, which can lead to cache poisoning, access control bypass, and session hijacking.

Recommendations Update Eclipse Jetty to a version later than 12.1.6. Update Eclipse Jetty to a version later than 12.0.32. Update Eclipse Jetty to a version later than 11.0.27. Update Eclipse Jetty to a version later than 10.0.27. Update Eclipse Jetty to a version later than 9.4.59.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-2332

GHSA-355H-QMC2-WPWF

OPENSUSE-SU-2026:10574-1

Affected Products

Jetty

Rocky Linux

References · 23

• https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2332 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-355h-qmc2-wpwf · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-2332 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10574-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2332 · Security Note
• https://gitlab.eclipse.org/security/cve-assignment/-/issues/89 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:20568 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-2332 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2332 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-2332 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-2332 · Vendor Advisory
• https://github.com/jetty/jetty.project · Note
• https://suse.com/security/cve/CVE-2026-5795 · Note
• https://twitter.com/CVEnew/status/2045972387876016421 · Twitter Post