CVE-2026-2332: 
Java vulnerability analysis and mitigation

CVE-2026-2332 is an HTTP Request Smuggling vulnerability in Eclipse Jetty's HTTP/1.1 chunked transfer encoding parser, classified under CWE-444. The flaw was discovered as a new variant of the "Funky Chunks" HTTP request smuggling research and publicly disclosed on April 14, 2026. It affects Eclipse Jetty versions 9.4.0–9.4.59, 10.0.0–10.0.27, 11.0.0–11.0.27, 12.0.0–12.0.32, and 12.1.0–12.1.6, as well as downstream products including IBM API Connect and Oracle REST Data Services (versions 24.2.0–26.1.0). The CVSS v3.1 base score is 7.4 (High) per the GitHub Advisory, though Oracle's risk matrix assigns it 9.1 (Critical) in the context of Oracle REST Data Services (GitHub Advisory, Oracle CSPU May 2026).

The root cause (CWE-444) lies in Jetty's HTTP/1.1 parser incorrectly terminating chunk extension parsing at \r\n sequences found inside quoted strings, rather than treating them as a parse error as required by RFC 9112 Section 7.1.1 and RFC 9110 Section 5.6.4. Per the RFC, a quoted-string in a chunk extension value must continue until the closing DQUOTE, and embedded \r\n is not permitted. Jetty instead treats the \r\n inside an unclosed quoted string as the end of the chunk header line, causing subsequent data to be interpreted as a new HTTP request — enabling classic HTTP request smuggling. A public Python proof-of-concept demonstrates the attack by sending a single TCP connection with a crafted POST request containing 1;a="\r\n as the chunk extension, which causes Jetty to parse a smuggled GET /smuggled HTTP/1.1 request as a second independent request (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to inject arbitrary HTTP requests into the server's request processing pipeline. This can result in cache poisoning (smuggled responses corrupting shared caches), access control bypass (smuggled requests circumventing frontend security controls such as WAFs or reverse proxies), and session hijacking (smuggled requests capturing or manipulating other users' responses). Confidentiality and integrity are both rated High, as attackers can access unauthorized data and manipulate application behavior, though availability is not directly impacted (GitHub Advisory, Oracle CSPU May 2026).

1. Reconnaissance: Identify internet-facing Jetty servers (versions 9.4.0–9.4.59, 10.0.0–10.0.27, 11.0.0–11.0.27, 12.0.0–12.0.32, or 12.1.0–12.1.6) using tools like Shodan or Censys, or identify applications built on affected Jetty versions (e.g., Oracle REST Data Services, IBM API Connect).
2. Craft the smuggling payload: Construct a raw HTTP/1.1 request using chunked transfer encoding with a malformed chunk extension containing an unclosed quoted string followed by \r\n:

POST / HTTP/1.1\r\n
Host: localhost\r\n
Transfer-Encoding: chunked\r\n
\r\n
1;a="\r\n
X\r\n
0\r\n
\r\n
GET /smuggled HTTP/1.1\r\n
Host: localhost\r\n
Content-Length: 11\r\n
\r\n
"\r\n
Y\r\n
0\r\n
\r\n

3. Send via raw TCP: Use a raw socket (bypassing HTTP libraries that would normalize the request) to send the payload directly to the target Jetty server on port 8080 (or 443/8443 for HTTPS).
4. Observe smuggled request processing: The vulnerable Jetty parser terminates the chunk header at the \r\n inside the quoted string, treating the subsequent GET /smuggled HTTP/1.1 as a second independent request. The server returns two HTTP responses for a single TCP connection, confirming successful smuggling.
5. Leverage for attack objectives: Use the smuggled request to target internal endpoints, bypass WAF/proxy access controls, poison shared caches with crafted responses, or capture session tokens from other users' requests routed through the same connection (GitHub Advisory).

• Network: Single TCP connections to Jetty servers (port 8080, 8443, or 443) that elicit multiple HTTP responses; HTTP requests with Transfer-Encoding: chunked headers containing chunk extensions with unclosed double-quote characters followed by \r\n.
• Logs: Jetty access logs showing unexpected requests to internal or restricted endpoints (e.g., /smuggled, /admin, /internal) that were not directly initiated by clients; anomalous request sequences where a POST is immediately followed by a GET or other method within the same connection log entry.
• Network: Requests with malformed chunk extension values matching the pattern <size>;[ext-name]="<value>\r\n (unclosed quoted string) in raw HTTP traffic captures; unusual HTTP/1.1 traffic with Transfer-Encoding: chunked to endpoints that do not normally receive chunked requests.
• Process/Application: Unexpected application behavior such as responses being served to the wrong client, cache entries containing responses for unrelated requests, or access control decisions being applied to incorrect request paths.

Upgrade Eclipse Jetty to one of the following patched versions: 9.4.60, 10.0.28, 11.0.28, 12.0.33, or 12.1.7 (GitHub Advisory). For IBM API Connect deployments, apply the corresponding security updates from IBM support (IBM Advisory). For Oracle REST Data Services (versions 24.2.0–26.1.0), apply the May 2026 Oracle Critical Security Patch Update (Oracle CSPU May 2026). As an interim measure, deploy a Web Application Firewall (WAF) configured to detect and block HTTP requests containing malformed chunk extensions with unclosed quoted strings. No official workaround short of patching has been provided by the Jetty project.

The vulnerability was credited to researcher xclow3n, who discovered it as a new variant while investigating the "Funky Chunks" HTTP request smuggling research published at w4ke.info. The Jetty project published the advisory on April 14, 2026, and the vulnerability was subsequently picked up by SUSE (security update SUSE-SU-2026:1751-1), Red Hat (multiple errata including RHSA-2026:17668, RHSA-2026:20568, RHSA-2026:21773, RHSA-2026:22453, RHSA-2026:25089), and Oracle in its May 2026 CSPU. The Hacker News included it in a weekly security recap, and CISA referenced it in its weekly vulnerability bulletin (SB26-110), reflecting broad industry awareness (GitHub Advisory, Oracle CSPU May 2026).