Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Eclipse Foundation Eclipse Jetty — HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U H H N 9.1 .0121 66.1 —
AFFECTED
Product Versions Fixed
Eclipse Jetty 12.1.0 – —
TIMELINE
Feb 11 Reserved by eclipse
Apr 14 Published (CNA: eclipse)
Aug 17 EXPLOIT PUBLISHED — CVE-2026-2332 (Eclipse Foundation Eclipse Jetty). Public exploit reference added.
Aug 17 RESCORED — CVE-2026-2332 (Eclipse Foundation Eclipse Jetty). CVSS 7.4 → 9.1 (NVD).
Description
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here:
* https://w4ke.info/2025/06/18/funky-chunks.html
* https://w4ke.info/2025/10/29/funky-chunks-2.html
Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error.
POST / HTTP/1.1
Host: localhost
Transfer-Encoding: chunked
1;ext="val
X
0
GET /smuggled HTTP/1.1
...
Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| February 11, 2026 | Reserved | Reserved by eclipse |
| April 14, 2026 | Published | Published (CNA: eclipse) |
| August 17, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-2332 (Eclipse Foundation Eclipse Jetty). Public exploit reference added. |
| August 17, 2026 | RESCORED | RESCORED — CVE-2026-2332 (Eclipse Foundation Eclipse Jetty). CVSS 7.4 → 9.1 (NVD). |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Eclipse Foundation | Eclipse Jetty | Maven | 12.1.0 | — |
References (16)
- https://access.redhat.com/errata/RHSA-2026:10175 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:14272 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:17668 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:20568 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:21773 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:22453 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:25089 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:50221 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:50222 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:50223 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:50263 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/security/cve/CVE-2026-2332 [vdb-entry, x_refsource_REDHAT]
- https://bugzilla.redhat.com/show_bug.cgi?id=2458187 [issue-tracking, x_refsource_REDHAT]
- https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf [third-party-advisory]
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/89 [issue-tracking]
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json [x_sadp-csaf-vex]
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-2332 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.