CVE-2026-12606: 
Glassfish 취약성 분석 및 완화

CVE-2026-12606 is an HTTP request smuggling vulnerability in Eclipse Grizzly caused by improper parsing of malformed trailer headers. It affects Eclipse Grizzly versions 4.0.0 through 4.0.2 and 5.0.0 through 5.0.1 (i.e., before 5.0.2). The vulnerability was published on July 14, 2026, by the Eclipse Foundation. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). Eclipse Grizzly fails to correctly parse the trailer section when a trailer header line is malformed, creating an ambiguity in how the HTTP message boundaries are interpreted. An unauthenticated, network-based attacker can exploit this by sending specially crafted HTTP requests with malformed trailer headers, causing downstream systems or proxies to interpret request boundaries differently than Grizzly does. The attack requires specific deployment conditions (AT:P in CVSS v4.0), meaning a proxy or intermediary must be present in the request path for the smuggling to be effective (GitHub Advisory, Eclipse GitLab).

Successful exploitation allows an unauthenticated attacker to inject or smuggle malicious HTTP requests into the processing pipeline of downstream systems, potentially bypassing security controls such as WAFs or access control layers. The primary impact is on integrity (low), with no direct confidentiality or availability impact on the vulnerable system itself. In multi-tier architectures where Grizzly acts as an intermediary, smuggled requests could be used to poison shared connection queues, hijack other users' sessions, or manipulate how backend servers process subsequent requests (Feedly, GitHub Advisory).

1. Reconnaissance: Identify deployments of Eclipse Grizzly versions 4.0.0–4.0.2 or 5.0.0–5.0.1 that sit behind a reverse proxy, load balancer, or other HTTP intermediary, as the attack requires a multi-tier HTTP processing chain.
2. Craft malformed trailer header: Construct an HTTP/1.1 chunked request with a deliberately malformed trailer header line — for example, a trailer section with an invalid or ambiguous field name/value that Grizzly cannot correctly parse.
3. Send smuggled request: Transmit the crafted request to the Grizzly-fronted endpoint. The malformed trailer causes Grizzly and the downstream system to disagree on where the HTTP message ends, allowing a second, hidden request to be embedded in the body.
4. Exploit desynchronization: The smuggled request is interpreted by the backend or downstream system as a new, independent HTTP request, potentially targeting internal endpoints, bypassing access controls, or poisoning shared connection state.
5. Achieve objective: Depending on the target environment, the attacker may be able to hijack other users' requests, bypass authentication/authorization checks, or inject malicious content into responses served to other users (GitHub Advisory, Eclipse GitLab).

• Network: Unusual HTTP/1.1 chunked requests with malformed or unexpected trailer header fields sent to Grizzly-fronted endpoints; unexpected HTTP requests appearing in backend server logs that do not correspond to client-initiated requests.
• Logs: Grizzly or application server logs showing parsing errors or warnings related to trailer header processing; backend access logs containing requests with unexpected source IPs (the Grizzly server's IP rather than the original client) or anomalous request sequences.
• Application Behavior: Unexplained access to internal endpoints or resources by users who should not have access; session data belonging to one user appearing in another user's context.

The Eclipse Foundation has released Eclipse Grizzly version 5.0.2, which contains the fix for this vulnerability; users should upgrade to 5.0.2 or later as the primary remediation (GitHub Advisory, Eclipse GitLab). For the 4.x branch (4.0.0–4.0.2), no patched version is indicated; users should migrate to the 5.x branch. As a temporary workaround, implement strict HTTP header validation and request filtering at the network perimeter (e.g., WAF rules) to detect and block requests with malformed trailer headers (Feedly).