HTTP Request Smuggling in Jetty Server

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Eclipse Foundation

Description

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-19203

Affected Vendors & Products

Vendor	Product	Version / Range
eclipse	jetty	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability involves a client sending specially crafted HTTP/1.1 chunked requests to a Jetty server. The issue occurs because Jetty accepts a lone LF (line feed) character as a valid terminator in certain parts of chunked request parsing, such as chunk extensions, chunk data, or trailer termination. This can cause Jetty and intermediary proxies to interpret different request boundaries, leading to HTTP request smuggling.

Impact Analysis

This vulnerability can allow attackers to smuggle malicious HTTP requests through the server, potentially bypassing security controls, accessing unauthorized data, or performing actions on behalf of other users. It may also lead to cache poisoning or session hijacking if exploited in conjunction with a vulnerable proxy.

Mitigation Strategies

Update Jetty to the latest version that patches this vulnerability. Configure HTTP compliance mode to reject lone LF characters in chunked requests. Inspect network traffic for malformed chunked requests using tools like Wireshark or tcpdump.

Hi! I’m here to help you understand CVE-2026-19203. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70