Bug 2529768 (CVE-2026-19203) - CVE-2026-19203 org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests
Summary: CVE-2026-19203 org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling vi...
Keywords:
Status: NEW
Alias: CVE-2026-19203
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-08 12:47 UTC by OSIDB Bzimport
Modified: 2026-09-21 17:46 UTC (History)
66 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-08 12:47:37 UTC 
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.




This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.
Note You need to log in before you can comment on or make changes to this bug.