Read the docs
TI-2026-01972 Aliases CVE-2026-2332GHSA-355h-qmc2-wpwf

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Priority HIGH 74CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 23 fixed, 10 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01305 70th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.eclipse.jetty:jetty-http (Maven): 12.1.7, 12.0.33, 11.0.29 +2Red Hat: 22 advisoriesRed Hat: 23 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty12.1.0 – 12.1.6; 12.0.0 – 12.0.32; 11.0.0 – 11.0.28; 10.0.0 – 10.0.27; 9.4.0 – 9.4.59—No fix listedCNA
—org.eclipse.jetty:jetty-http (Maven)12.1.0 to before 12.1.712.1.7Patch availableGHSA-355h-qmc2-wpwf
—org.eclipse.jetty:jetty-http (Maven)12.0.0 to before 12.0.3312.0.33Patch availableGHSA-355h-qmc2-wpwf
—org.eclipse.jetty:jetty-http (Maven)11.0.0 to before 11.0.2911.0.29Patch availableGHSA-355h-qmc2-wpwf
—org.eclipse.jetty:jetty-http (Maven)10.0.0 to before 10.0.2810.0.28Patch availableGHSA-355h-qmc2-wpwf
—org.eclipse.jetty:jetty-http (Maven)9.4.0 to before 9.4.609.4.60Patch availableGHSA-355h-qmc2-wpwf
  • Eclipse Jetty VendorEclipse Foundation Affected 12.1.0 – 12.1.6; 12.0.0 – 12.0.32; 11.0.0 – 11.0.28; 10.0.0 – 10.0.27; 9.4.0 – 9.4.59 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-http (Maven) Vendor— Affected 12.1.0 to before 12.1.7 Fixed in 12.1.7 Patch available GHSA-355h-qmc2-wpwf
  • org.eclipse.jetty:jetty-http (Maven) Vendor— Affected 12.0.0 to before 12.0.33 Fixed in 12.0.33 Patch available GHSA-355h-qmc2-wpwf
  • org.eclipse.jetty:jetty-http (Maven) Vendor— Affected 11.0.0 to before 11.0.29 Fixed in 11.0.29 Patch available GHSA-355h-qmc2-wpwf
  • org.eclipse.jetty:jetty-http (Maven) Vendor— Affected 10.0.0 to before 10.0.28 Fixed in 10.0.28 Patch available GHSA-355h-qmc2-wpwf
  • org.eclipse.jetty:jetty-http (Maven) Vendor— Affected 9.4.0 to before 9.4.60 Fixed in 9.4.60 Patch available GHSA-355h-qmc2-wpwf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*9.4.0 to before 9.4.60; 10.0.0 to before 10.0.28; 11.0.0 to before 11.0.28; 12.0.0 to before 12.0.33; 12.1.0 to before 12.1.7VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.4.0 to before 9.4.60; 10.0.0 to before 10.0.28; 11.0.0 to before 11.0.28; 12.0.0 to before 12.0.33; 12.1.0 to before 12.1.7 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-355h-qmc2-wpwf org.eclipse.jetty:jetty-http (Maven) Fixed in 12.1.7 Advisory →
  • Fix · GHSA-355h-qmc2-wpwf org.eclipse.jetty:jetty-http (Maven) Fixed in 12.0.33 Advisory →
  • Fix · GHSA-355h-qmc2-wpwf org.eclipse.jetty:jetty-http (Maven) Fixed in 11.0.29 Advisory →
  • Fix · GHSA-355h-qmc2-wpwf org.eclipse.jetty:jetty-http (Maven) Fixed in 10.0.28 Advisory →
  • Fix · GHSA-355h-qmc2-wpwf org.eclipse.jetty:jetty-http (Maven) Fixed in 9.4.60 Advisory →

Red Hat 22 advisories

  • RHSA-2026:60259 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60256 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60254 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 19 more Red Hat advisories
  • RHSA-2026:60252 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60251 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60250 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60249 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60248 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60247 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60246 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60239 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:50263 Released 2026-08-04 · Red Hat rating Important
    Satellite 6.18.8 Async Update
    • Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.24.1-3.el9sat, openvox-server-8.14.1-1.el9sat, python3.12-pillow-12.3.0-1.el9pc +5
  • RHSA-2026:50223 Released 2026-08-04 · Red Hat rating Important
    Satellite 6.16.12 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 libsolv-1:0.7.20-7.el8sat, openvox-agent-8.24.1-3.el8sat, openvox-server-8.14.1-1.el8sat +9
    • Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.24.1-3.el9sat, openvox-server-8.14.1-1.el9sat, python-pillow-12.3.0-1.el9pc +7
  • RHSA-2026:50222 Released 2026-08-04 · Red Hat rating Important
    Satellite 6.17.10 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.24.1-3.el9sat, openvox-server-8.14.1-1.el9sat, python-pillow-12.3.0-1.el9pc +7
  • RHSA-2026:50221 Released 2026-08-04 · Red Hat rating Important
    Satellite 6.19.3 Async Update
    • Red Hat Satellite 6.19 for RHEL 9 openvox-server-8.14.1-1.el9sat, python3.12-pillow-12.3.0-1.el9pc, rubygem-faraday-1.10.6-1.el9sat +2
  • RHSA-2026:25089 Released 2026-06-10 · Red Hat rating Important
    HawtIO 4.4.0 for Red Hat build of Apache Camel 4 Release and security update.
    • HawtIO HawtIO 4.4.0
  • RHSA-2026:22453 Released 2026-06-02 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.1.GA)
    • Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
  • RHSA-2026:21773 Released 2026-05-28 · Red Hat rating Important
    Red Hat Offline Knowledge Portal security and content update
    • Red Hat Offline Knowledge Portal 1.2.13 registry.redhat.io/offline-knowledge-portal/rhokp-rhel9
  • RHSA-2026:20568 Released 2026-05-26 · Red Hat rating Important
    jmc security update
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) jmc-8.2.0-19.el9_8.2
  • RHSA-2026:17668 Released 2026-05-14 · Red Hat rating Critical
    Red Hat Build of Apache Camel 4.18.1 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
  • RHSA-2026:14272 Released 2026-05-06 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.5 release and security update
    • Red Hat AMQ Broker 7.13.5
  • RHSA-2026:10175 Released 2026-04-23 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.27.1 Release.
    • Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/devspaces-rhel9-operator +8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Web Server 6AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Debezium 2AffectedNo fix planned: Out of support scope
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
streams for Apache Kafka 2AffectedNo fix planned: Will not fix
streams for Apache Kafka 3AffectedNo fix planned: Will not fix
HawtIO HawtIO 4.4.0Fixed RHSA-2026:25089
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:60247
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:60249
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:60248
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:60239
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:60251
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:60246
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:60250
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:60252
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:60259
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:60254
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:60256
Red Hat AMQ Broker 7.13.5Fixed RHSA-2026:14272
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33Fixed RHSA-2026:22453
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:20568
Red Hat Offline Knowledge Portal 1.2.13Fixed RHSA-2026:21773
Red Hat OpenShift Dev Spaces 3.27Fixed RHSA-2026:10175
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:50223
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:50223
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:50222
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:50263
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:50221
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14Fixed RHSA-2026:17668
Not affected: 24 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat Data Grid 8
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Dev Spaces 3.27
  • Red Hat Process Automation 7
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Apicurio Registry 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-2332
  2. 2026-10-03 Alias added: GHSA-355h-qmc2-wpwf
  3. 2026-10-09 Fix available: RHSA-2026:22453 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:14272 · Red Hat
  5. 2026-10-10 Fix available: Red Hat AMQ Broker 7.13.5, Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 · Red Hat
  6. 2026-10-20 Affected versions changed · Red Hat

References

Exploit 1

Advisory 2

Other 16

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2024-14794 Jetty connection leaking on idle timeout when TCP congested CVSS 3.1HIGH 7.5
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences