CVE-2026-93003
Received Received - Intake

HTTP Header Injection in Eclipse Jetty Web Add-on

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Eclipse Foundation

Description
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing decisions it should not be able to reach.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-93003
EUVD
EUVD-2026-105153

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse ThreadX - NetX Duo 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the NetX Duo Web HTTP server incorrectly interpreting request body content as HTTP header fields. The server scans the entire request packet for headers instead of stopping at the end of the header section as required by RFC 7230. Attackers can manipulate request framing by placing header field names in the request body, leading to inconsistencies in how the server processes requests.

Detection Guidance

To detect this vulnerability, monitor HTTP requests for malformed headers or unusual request framing. Inspect server logs for requests where header-like fields appear in the body. Use network tools like Wireshark to capture and analyze HTTP traffic for non-standard header placements.

Impact Analysis

If the server is behind a front-end proxy using Content-Length for framing, an attacker could perform request smuggling. If directly exposed, the impact is limited to misparsed or rejected requests for the attacker's own connection. The vulnerability does not involve memory corruption or information disclosure.

Mitigation Strategies

Upgrade NetX Duo to version 6.5.2.202603 or later. If upgrading is not possible, avoid requests with bodies, restrict request methods, or ensure proxies normalize request framing to prevent request smuggling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93003. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart