CVE-2026-2332 — HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Description (CNA)

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

Affected (CNA)

Vendor / product	Versions
Eclipse Foundation / Eclipse Jetty	affected 12.1.0 through 12.1.6; affected 12.0.0 through 12.0.32; affected 11.0.0 through 11.0.28; affected 10.0.0 through 10.0.27; affected 9.4.0 through 9.4.59

CWE

CWE-444

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.