Vulnerability Description
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Eclipse | Jetty | >= 9.4.0, < 9.4.60 |
Related Weaknesses (CWE)
References
- https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwfExploitVendor AdvisoryMitigation
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/89Issue TrackingVendor Advisory
FAQ
What is CVE-2026-2332?
CVE-2026-2332 is a vulnerability with a CVSS score of 7.4 (HIGH). In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky...
How severe is CVE-2026-2332?
CVE-2026-2332 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-2332?
Check the references section above for vendor advisories and patch information. Affected products include: Eclipse Jetty.