CVE-2026-19203: High severity Eclipse Jetty vulnerability
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.
This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Jetty deployments that receive HTTP/1.1 chunked requests through an intermediary proxy are the relevant exposure scenario, because exploitation depends on Jetty and the proxy interpreting request boundaries differently. Whether a given deployment is affected also depends on the Jetty version and configured HTTP compliance mode.
What does an attacker need to exploit it?
An attacker needs to be able to send specially crafted HTTP/1.1 chunked requests to the Jetty server through a proxy or other intermediary that parses the request differently. The malformed parsing involves a lone LF character in chunk extensions, chunk-data termination, or trailer termination, depending on the Jetty version and compliance configuration.