CVE-2026-2332
Eclipse Jetty 9.4.0 – 9.4.60
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NSummary
CVE-2026-2332 is a high-severity HTTP Request/Response Smuggling (CWE-444) vulnerability in Eclipse Jetty. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-7 (Boundary Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-2332 affects the HTTP/1.1 parser in Eclipse Jetty, enabling HTTP request smuggling when chunk extensions are used in chunked transfer-encoded requests. The vulnerability arises because Jetty terminates chunk extension parsing upon encountering \r\n inside quoted strings rather than treating it as an error. This flaw is similar to "funky chunks" techniques documented at https://w4ke.info/2025/06/18/funky-chunks.html and https://w4ke.info/2025/10/29/funky-chunks-2.html. For example, a malformed request like POST / HTTP/1.1 with Transfer-Encoding: chunked, a chunk "1;ext=\"val\nX\n0", followed by a smuggled "GET /smuggled HTTP/1.1\n...", allows injection of additional requests.
Remote network attackers can exploit this without privileges or user interaction, though it requires high attack complexity. By crafting a chunked POST request with an unclosed quoted string in the chunk extension, the attacker causes the parser to prematurely end processing, smuggling a subsequent request such as a GET to a target endpoint. This leads to inconsistent interpretation of HTTP requests (CWE-444), with potential for high confidentiality and integrity impacts (CVSS 7.4: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), such as bypassing security controls or accessing sensitive data.
Official advisories provide mitigation guidance, including the Jetty project security advisory at https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf and the Eclipse security issue at https://gitlab.eclipse.org/security/cve-assignment/-/issues/89, published on 2026-04-14.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22243
Vulnerability Data
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of…
more
treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V4.1.3V4.2.4V1.5.3V4.1.1
Mitigating Controls (NIST 800-53 r5) AI
Boundary protection at external interfaces can enforce consistent HTTP request/response parsing rules between intermediaries and endpoints.
Validating HTTP inputs at the intermediary prevents malformed messages from being interpreted inconsistently downstream.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Configuration management can enforce uniform HTTP parsing rules across intermediaries, directly mitigating inconsistent interpretation.
Network monitoring can detect smuggling attempts via anomalous HTTP traffic or logs, while eliminating the inconsistency directly aids detection of such events.
Network protections can enforce consistent HTTP proxy/firewall behavior to block smuggling, and removing the weakness helps prevent unauthorized access via request smuggling.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect HTTP request smuggling vulnerabilities in intermediary components.
Network security controls can enforce consistent HTTP parsing and proxy behavior that mitigates request smuggling.
Secure network services include hardening proxies and gateways against inconsistent HTTP interpretation.
Secure SDLC practices require threat modeling and testing for HTTP parsing inconsistencies in intermediaries.
Application security requirements can mandate strict HTTP message validation and canonicalization.
Secure architecture principles include consistent protocol handling and defense-in-depth for proxies.