Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / maven/org.eclipse.jetty/jetty-http/CVE-2026-2332
Advisory ID gitlab/maven/org.eclipse.jetty/jetty-http/CVE-2026-2332
Aliases CVE-2026-2332
GHSA-355h-qmc2-wpwf
Summary Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing - **Request Smuggling**: Attacker injects arbitrary HTTP requests - **Cache Poisoning**: Smuggled responses poison shared caches - **Access Control Bypass**: Smuggled requests bypass frontend security - **Session Hijacking**: Smuggled requests can steal other users' responses
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (3)
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty/jetty-http/CVE-2026-2332.yml
Reference id Reference type URL
https://nvd.nist.gov/vuln/detail/CVE-2026-2332
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json
https://w4ke.info/2025/06/18/funky-chunks.html
2458187 Bug https://bugzilla.redhat.com/show_bug.cgi?id=2458187
89 Bug https://gitlab.eclipse.org/security/cve-assignment/-/issues/89
CVE-2026-2332 https://access.redhat.com/security/cve/CVE-2026-2332
GHSA-355h-qmc2-wpwf https://github.com/advisories/GHSA-355h-qmc2-wpwf
GHSA-355h-qmc2-wpwf Advisory https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf
RHSA-2026:10175 https://access.redhat.com/errata/RHSA-2026:10175
RHSA-2026:14272 https://access.redhat.com/errata/RHSA-2026:14272
RHSA-2026:17668 Advisory https://access.redhat.com/errata/RHSA-2026:17668
RHSA-2026:20568 https://access.redhat.com/errata/RHSA-2026:20568
RHSA-2026:21773 https://access.redhat.com/errata/RHSA-2026:21773
RHSA-2026:22453 Advisory https://access.redhat.com/errata/RHSA-2026:22453
RHSA-2026:25089 https://access.redhat.com/errata/RHSA-2026:25089
RHSA-2026:50221 Advisory https://access.redhat.com/errata/RHSA-2026:50221
RHSA-2026:50222 Advisory https://access.redhat.com/errata/RHSA-2026:50222
RHSA-2026:50223 Advisory https://access.redhat.com/errata/RHSA-2026:50223
RHSA-2026:50263 Advisory https://access.redhat.com/errata/RHSA-2026:50263
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty/jetty-http/CVE-2026-2332.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-14T13:06:34Z/

Decision: Track*

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/2xxx/CVE-2026-2332.json

Source Advisory: vulnrichment/CVE-2026-2332

View SSVC decision tree 
[{'Exploitation': 'poc'},
 {'Automatable': 'no'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]