InfoSec Signals™
Sign InStart Free
Back to CVE records
High 7.4Published Apr 14, 2026

CVE-2026-2332HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Updated under an hour ago ()

Does this affect you?

It affects Eclipse Foundation Eclipse Jetty and 23 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

CVSS
7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE)
CWE-444
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
eclipse
NVD analysis
Modified
Record last updated
Sep 14, 2026
First seen by InfoSec Signals
Oct 9, 2026

Affected products

Affected products
Eclipse Foundation Eclipse Jetty
eclipse_foundation:eclipse_jetty (from the name)
from 12.1.0 through 12.1.6; from 12.0.0 through 12.0.32; from 11.0.0 through 11.0.28; from 10.0.0 through 10.0.27; from 9.4.0 through 9.4.59
CNA record
Red Hat HawtIO HawtIO 4.4.0
redhat:apache_camel_hawtio
4.4
CISA ADP
7.13
CISA ADP
4.18
CISA ADP
3.33
CISA ADP
Red Hat Red Hat Enterprise Linux 9
redhat:enterprise_linux
from 0:8.2.0-19.el9_8.2 not affected
CISA ADP
from 0:8.14.1-1.el8sat not affected
CISA ADP
from 0:8.14.1-1.el8sat not affected
CISA ADP
from 1786628667 not affected
CISA ADP
from 1779996999 not affected
CISA ADP
from 1776716842 not affected
CISA ADP
3
CISA ADP
2
CISA ADP
3
CISA ADP
2
CISA ADP
Red Hat Red Hat Data Grid 8
redhat:jboss_data_grid
8
CISA ADP
Red Hat Red Hat Fuse 7
redhat:jboss_fuse
7
CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform 7
redhat:jboss_enterprise_application_platform
7
CISA ADP
Versions not stated
CISA ADP
Red Hat Red Hat JBoss Web Server 6
redhat:jboss_enterprise_web_server
6
CISA ADP
Red Hat Red Hat Process Automation 7
redhat:jboss_enterprise_bpms_platform
7
CISA ADP
Red Hat Red Hat Single Sign-On 7
redhat:red_hat_single_sign_on
7
CISA ADP
2
CISA ADP
eclipse jetty
eclipse:jetty
from 9.4.0 before 9.4.60; from 10.0.0 before 10.0.28; from 11.0.0 before 11.0.28; from 12.0.0 before 12.0.33; from 12.1.0 before 12.1.7
NVD

References

  • third-party-advisory, exploit, mitigation, vendor-advisory
  • issue-tracking, vendor-advisory

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.