CVE-2026-12606

State: Published
Severity: 6.3 Medium
Published: Jul 14, 2026
Updated: Jul 27, 2026
Reserved: Jun 18, 2026

Description

Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to "true".

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	eclipse

Weaknesses

CWE-444 Inconsistent Interpretation of HTTP Requests

Affected Products

Product	Versions
Eclipse GlassFishEclipse Foundation	4.0.0 through 4.0.2Affected 5.0.0 to before 5.0.2Affected

References

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/129

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.