CVE-2026-19203

EUVD-2026-72718

08.09.2026, 13:17

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.




This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.

HTTP Request/Response Smuggling

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
eclipse	CNA	8.3 HIGH	NETWORK	LOW	NONE	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
eclipse	jetty	12.1.0 ≤ 𝑥 ≤ 12.1.11	CNA
eclipse	jetty	12.0.0 ≤ 𝑥 ≤ 12.0.37	CNA
eclipse	jetty	11.0.0 ≤ 𝑥 ≤ 11.0.31	CNA
eclipse	jetty	10.0.0 ≤ 𝑥 ≤ 10.0.31	CNA
eclipse	jetty	9.4.0 ≤ 𝑥 ≤ 9.4.63	CNA

Common Weakness Enumeration

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References

https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h