CVE-2026-19203

State: Published
Severity: 8.3 High
Published: Sep 8, 2026
Updated: Sep 8, 2026
Reserved: Aug 7, 2026

Description

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.

This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.

Scores

CVSS	Score	Vector	Source
4.0	8.3 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N	eclipse

Weaknesses

CWE-444 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')

Affected Products

Product	Versions
Eclipse JettyEclipse Foundation	12.1.0 through 12.1.11Affected 12.0.0 through 12.0.37Affected 11.0.0 through 11.0.31Affected 10.0.0 through 10.0.31Affected 9.4.0 through 9.4.63Affected

References

https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.