CVE-2026-2332

What it actually does

The HTTP/1.1 chunked transfer encoding parser in Jetty mishandles quoted strings in chunk extensions by terminating on an embedded CRLF instead of treating it as a syntax error, allowing an attacker to inject a second HTTP request that is parsed as part of the first.

Why it matters to the business

Attackers can bypass front-end security controls such as WAFs or authentication gateways, reach internal application endpoints, and perform unauthorized actions against backend services that trust the proxy chain.

How an attack unfolds

An attacker crafts a chunked POST request whose chunk-extension quoted string contains an unterminated quote followed by CRLF and a complete second HTTP request; Jetty's parser accepts the CRLF inside the quotes, emits both requests downstream, and any subsequent proxy or origin server processes the smuggled request as a separate, attacker-controlled transaction.

How to fix it

Upgrade Eclipse Jetty to a version that correctly rejects CRLF characters inside quoted chunk extensions; until a patched release is available, enforce request normalization or chunked-encoding validation at any upstream reverse proxy or WAF, and consider disabling HTTP/1.1 chunked encoding where operationally feasible.

How to confirm the fix worked

After applying an update, replay the proof-of-concept request from the Funky Chunks publications and confirm that the server returns a 400 Bad Request instead of forwarding both requests; additionally run automated HTTP request-smuggling test suites against the patched instance.

Typical attack path

1. Identify a Jetty-based origin or reverse-proxy that accepts HTTP/1.1 chunked requests
2. Send a single HTTP/1.1 POST containing a chunked body with a malformed chunk-extension quoted string that embeds CRLF and a second request line plus headers
3. The smuggled request is forwarded or processed independently, bypassing any per-request security checks performed on the outer request
4. Attacker observes or acts on the response to the hidden request

How to detect it

Search web-access and proxy logs for chunked requests whose chunk-extension fields contain embedded CRLF sequences or unbalanced quotation marks; correlate any such entries with subsequent requests that appear without corresponding outer-request metadata.

What your security team should do

• Treat the issue as high priority for any internet-facing Jetty deployments even though EPSS remains low
• Inventory all Eclipse Jetty versions in use and subscribe to Jetty release announcements for the forthcoming fix
• Add WAF or proxy rules that reject chunk extensions containing unescaped CRLF or unbalanced quotes until patches are deployed
• Monitor downstream dependency counts and schedule upgrades for any frameworks that embed Jetty