CVE-2026-19203
published 2026-09-08CVE-2026-19203: A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request…
PriorityP351high8.3CVSS 4.0
AVNACLATPPRNUINVCLVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.31%
22.1th percentile
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.
This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | puppetserver | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| eclipse_foundation | eclipse_jetty | 10.0.0 – 10.0.31 | — |
| eclipse_foundation | eclipse_jetty | 11.0.0 – 11.0.31 | — |
| eclipse_foundation | eclipse_jetty | 12.0.0 – 12.0.37 | — |
| eclipse_foundation | eclipse_jetty | 12.1.0 – 12.1.11 | — |
| eclipse_foundation | eclipse_jetty | 9.4.0 – 9.4.63 | — |
| exploit-intelligence | agent-client-rhel9 | — | — |
| jenkins | jenkins | — | — |
| maven_3.9 | maven-resolver | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
| offline-knowledge-portal | rhokp-rhel9 | — | — |
| opendaylight | opendaylight | — | — |
| redhat-user-workloads | rhokp-core-encrypted | — | — |
| rhoai | odh-spark-operator-rhel9 | — | — |
| rhoai | odh-th-torch-cpu-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cuda-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
CVSS provenance
nvdv4.08.3HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests
vendor_redhat·2026-09-08·CVSS 8.3
CVE-2026-19203 [HIGH] CWE-444 org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests
org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.
This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.
A flaw was found in Jetty. A remote attacker can exploit this vulnerability by sending specially crafted HTTP/1.1 chunked requests. This can cause Jetty and an intermediary proxy to interpret different request boundaries, potentially
GHSA
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP req
ghsa_unreviewed·2026-09-08
CVE-2026-19203 [HIGH] CWE-444 A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP req
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.
This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.
No detection rules found.
No public exploits indexed.
2026-09-08
Published