CVE-2026-2332 is a high severity HTTP request smuggling flaw (CVSS 7.4) in Eclipse Jetty. Its HTTP/1.1 parser ends chunk extension parsing at a line break inside a quoted string instead of treating it as an error. Fixes are in Jetty 12.1.7, 12.0.33, 11.0.29, 10.0.28 and 9.4.60.
What's affected
The GitHub advisory for the jetty-http Maven package lists these ranges and patched versions:
- 12.1.x: 12.1.0 through 12.1.6, fixed in 12.1.7
- 12.0.x: 12.0.0 through 12.0.32, fixed in 12.0.33
- 11.0.x: 11.0.0 through 11.0.28, fixed in 11.0.29
- 10.0.x: 10.0.0 through 10.0.27, fixed in 10.0.28
- 9.4.x: 9.4.0 through 9.4.59, fixed in 9.4.60
Jetty is embedded in many products, so you may run it without having chosen it. Application servers, build tools, message brokers and vendor appliances can carry their own copy.
The record references Red Hat errata for packaged builds, so Linux distributions have shipped fixes in their own packages.
How to check if you're exposed
For a Java project, find the resolved version of the jetty-http artifact:
mvn dependency:tree -Dincludes=org.eclipse.jetty:jetty-http
./gradlew dependencies | grep jetty-http
For standalone Jetty, run java -jar start.jar --version from the Jetty home directory. For products that bundle Jetty, look for jetty jar files and read the version in their names:
find / -name "jetty-http*.jar" 2>/dev/null
Where Jetty sits behind a reverse proxy or load balancer that handles chunked requests differently, the risk of a mismatch between the two is what matters, so note that topology too.
What to do now
- Upgrade Jetty to the patched release for your branch.
- For products that bundle Jetty, apply the vendor update or the distribution package that lists the fix.
- Check whether a front end proxy forwards chunked requests with extensions, and keep it patched too.
- Redeploy and confirm the new version with the commands above.
- Add jetty-http to dependency monitoring across your services.
Why it matters
The weakness is CWE-444 (HTTP Request Smuggling). Two HTTP parsers disagree about where one request ends and the next begins. When a front end and a back end split the same byte stream differently, an attacker can hide a second request inside the first, and the back end processes it as if it came from someone else.
This case is a variant of techniques the advisory calls "funky chunks". It lives in chunk extensions, an obscure part of HTTP/1.1 that few applications use but every parser must handle. The Jetty parser ended extension parsing at a line break inside quotes, where the rules call for an error. Smuggling can bypass access controls at the proxy, poison caches and expose other users' requests, depending on the architecture. The CVSS score reflects high attack complexity because it needs a specific front end and back end combination. The record does not mark this CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect me if Jetty is the only server in the path?
The risk depends on a mismatch between two parsers. Upgrading closes the Jetty side regardless, and a lone server is a lower risk than a proxy plus Jetty.
Where might Jetty be hiding in my estate?
In application servers, build tools, brokers and appliances that embed it. A scan of your dependency inventory or the jar search above will find them.
Sources
Last reviewed: 19 October 2026.
