CVE-2026-2332 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Attackers can smuggle HTTP requests via malformed chunk extensions in Eclipse Jetty, bypassing security controls and accessing unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2332?
CVE-2026-2332 is a high-severity vulnerability in Eclipse Jetty, published on 14 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html
* https://w4ke.info/2025/10/29/funky-chunks-2.html
Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error.
POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked
1;ext="val X 0
GET /smuggled HTTP/1.1 ...
Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
Weakness: CWE-444
Which versions are affected by CVE-2026-2332?
10 open source packages ship an affected version, including org.eclipse.jetty:jetty-http. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-http Maven | From 10.0.0 | 10.0.28 |
org.eclipse.jetty:jetty-http Maven | From 10.0.0 | 10.0.28 |
org.eclipse.jetty:jetty-http Maven | From 11.0.0 | 11.0.29 |
org.eclipse.jetty:jetty-http Maven | From 11.0.0 | 11.0.29 |
org.eclipse.jetty:jetty-http Maven | From 12.0.0 | 12.0.33 |
org.eclipse.jetty:jetty-http Maven | From 12.0.0 | 12.0.33 |
4 more packages
org.eclipse.jetty:jetty-http Maven | From 12.1.0 | 12.1.7 |
org.eclipse.jetty:jetty-http Maven | From 12.1.0 | 12.1.7 |
org.eclipse.jetty:jetty-http Maven | From 9.4.0 | 9.4.60 |
org.eclipse.jetty:jetty-http Maven | From 9.4.0 | 9.4.60 |
Products include Eclipse Jetty.
How do I fix CVE-2026-2332?
Upgrade org.eclipse.jetty:jetty-http to a fixed version for your release line: 10.0.28, 11.0.29, 12.0.33 or 12.1.7.
Is CVE-2026-2332 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-2332 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Eclipse Jetty
- CVE-2016-4800 Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
- CVE-2019-17638 Operation on a Resource after Expiration or Release in Jetty Server
- CVE-2018-12538 Access and integrity issue within Eclipse Jetty
- CVE-2026-10050 Digest authentication lossy encoding
- CVE-2025-5115 MadeYouReset HTTP/2 vulnerability
Sources
Also known as CLEANSTART-2026-BV16840, CLEANSTART-2026-GI93885, CLEANSTART-2026-JJ33513, CLEANSTART-2026-LU31702, CLEANSTART-2026-PV64921, CLEANSTART-2026-TR58651 and 88 more.