CVE-2026-19203

EUVD-2026-72718

08.09.2026, 13:17

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.




This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.

HTTP Request/Response Smuggling

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
eclipse	CNA	8.3 HIGH	NETWORK	LOW	NONE	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 22.08%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
eclipse	jetty	12.1.0 ≤ 𝑥 ≤ 12.1.11	CNA
eclipse	jetty	12.0.0 ≤ 𝑥 ≤ 12.0.37	CNA
eclipse	jetty	11.0.0 ≤ 𝑥 ≤ 11.0.31	CNA
eclipse	jetty	10.0.0 ≤ 𝑥 ≤ 10.0.31	CNA
eclipse	jetty	9.4.0 ≤ 𝑥 ≤ 9.4.63	CNA

Debian Releases

Debian Product

Codename

jetty12

forky	vulnerable
sid	12.0.40-1 fixed
trixie	vulnerable
trixie (security)	vulnerable

jetty9

bookworm	vulnerable
bookworm (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	vulnerable
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

jetty

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage
xenial	needs-triage

jetty12

jammy	dne
noble	dne
resolute	needs-triage

jetty9

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

Common Weakness Enumeration

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Vulnerability Media Exposure

[GERMAN] Eclipse Jetty: Schwachstelle ermöglicht Darstellen falscher Informationen und Offenlegung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Eclipse Jetty ausnutzen, um falsche Informationen darzustellen und Informationen offenzulegen.
Published: 2026-09-16T22:00:00+00:00

References

https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h