CVE-2026-19203 A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret dif
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-19203?
CVE-2026-19203 is a high-severity vulnerability in Eclipse Jetty, published on 8 Sep 2026.
Official description
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.
This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.
Weakness: CWE-444
Which versions are affected by CVE-2026-19203?
How do I fix CVE-2026-19203?
Upgrade to a fixed version.
Is CVE-2026-19203 being exploited?
There is no known exploitation of CVE-2026-19203 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-HU83595, CLEANSTART-2026-IE92648, CLEANSTART-2026-IM74303, CLEANSTART-2026-LJ21739, CLEANSTART-2026-MJ80474, CLEANSTART-2026-NQ39719 and 6 more.