CVE-2026-2332 in Jetty
Summary
by MITRE • 04/14/2026
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html
* https://w4ke.info/2025/10/29/funky-chunks-2.html
Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error.
POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked
1;ext="val X 0
GET /smuggled HTTP/1.1 ...
Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified as CVE-2026-2332 affects the Eclipse Jetty HTTP/1.1 parser implementation and represents a critical request smuggling flaw that exploits improper handling of chunk extensions within HTTP transfer encoding. This vulnerability allows attackers to inject malicious requests that can bypass security controls and potentially access restricted resources or perform unauthorized operations. The flaw specifically manifests when the HTTP parser encounters chunk extensions that contain unescaped quotes, creating a parsing inconsistency that enables request smuggling techniques similar to those described in the "funky chunks" research documented by w4ke.info. The issue stems from Jetty's failure to properly validate chunk extension syntax, particularly when quoted strings are not properly terminated within chunk extension parameters. When processing the malformed chunk extension containing an unterminated quoted string, the parser incorrectly continues parsing rather than terminating the chunk extension parsing process, which creates a parsing ambiguity that attackers can exploit to inject additional HTTP requests.
The technical implementation of this vulnerability demonstrates a clear violation of secure parsing practices and can be classified under CWE-1294, which addresses improper handling of HTTP chunk extensions. The vulnerability operates at the protocol level where HTTP/1.1 chunked transfer encoding is processed, and it specifically targets the parser's state management when encountering malformed chunk extension syntax. In the demonstrated exploit example, the attacker constructs a chunk extension with an unterminated quoted string that spans multiple lines, allowing the parser to interpret the continuation as part of the chunk extension rather than as a new HTTP request. This parsing inconsistency creates a situation where the HTTP message boundary is not properly respected, enabling an attacker to smuggle a second request within the first chunked request body. The vulnerability is particularly concerning because it operates at the HTTP layer and can potentially bypass application-level security controls, making it a significant threat to web application security.
The operational impact of CVE-2026-2332 extends beyond simple request smuggling to encompass potential privilege escalation, data exfiltration, and service disruption scenarios. Attackers can leverage this vulnerability to bypass authentication mechanisms, access restricted resources, or perform operations that should be restricted to authorized users. The vulnerability affects any system running Jetty that processes chunked HTTP requests, making it particularly dangerous in environments where Jetty serves as a reverse proxy or gateway for other services. The attack vector is particularly insidious because it can be executed through standard HTTP request processing without requiring special privileges or complex exploitation techniques. The vulnerability can be exploited by attackers who have access to the affected system or network, potentially leading to full system compromise if the vulnerable Jetty instance processes requests from untrusted sources.
Mitigation strategies for CVE-2026-2332 should focus on implementing proper input validation and ensuring that chunk extensions are strictly validated according to HTTP/1.1 specifications. Organizations should immediately upgrade to patched versions of Eclipse Jetty that properly handle chunk extension parsing and terminate parsing at quoted string boundaries instead of continuing processing. The implementation should include strict validation of chunk extension syntax, ensuring that all quoted strings are properly terminated before continuing with further parsing. Additionally, security teams should implement monitoring and logging of chunked request processing to detect anomalous parsing behavior that may indicate exploitation attempts. Network-level protections such as web application firewalls and HTTP request filtering can provide additional layers of defense, though the most effective mitigation remains the immediate patching of affected Jetty versions. The vulnerability also highlights the importance of adhering to ATT&CK framework techniques related to protocol manipulation and HTTP request smuggling, which can help security teams better detect and respond to such attacks through proper monitoring and incident response procedures.