Jetty patches HTTP request smuggling via chunk extensions

TL;DR — Jetty’s HTTP/1.1 chunked-transfer parsing can be desynchronized using crafted chunk extensions, enabling HTTP request smuggling when Jetty sits behind a frontend proxy/load balancer.

What happened

Eclipse Jetty is a popular Java web server and HTTP client/server component, commonly deployed behind reverse proxies and L7 load balancers.

CVE-2026-2332 describes a request smuggling issue in Jetty’s HTTP/1.1 parser when chunk extensions are present in Transfer-Encoding: chunked requests. The CVE notes Jetty can incorrectly terminate chunk-extension parsing at a CRLF inside a quoted string (instead of rejecting it as a parsing error). In real deployments where a frontend and backend interpret the same bytes differently, this can enable “desync” behavior where a smuggled request is processed by the backend.

Why this matters: request smuggling is an application-layer cross-component parsing failure mode that can bypass frontend controls, poison caches, or cross tenant/user boundaries in shared proxy tiers—especially in “proxy → app server” architectures that are ubiquitous in production.

Who is impacted

• Jetty deployments using the org.eclipse.jetty:jetty-http component in the affected ranges below.
• Highest-risk environments where Jetty is deployed behind a reverse proxy / load balancer (i.e., anywhere differential parsing between components can occur).

What to do now

• Follow vendor remediation guidance and apply a Jetty release that includes the fix.
• Jetty’s GitHub Security Advisory for this issue lists the following patched versions:

  12.1.7, 12.0.33, 11.0.28, 10.0.28, 9.4.60

• Inventory where Jetty is embedded vs explicitly depended on (application servers, shaded JARs, platform “starter” stacks), and prioritize upgrades for internet-facing services and shared reverse-proxy tiers.
• If you operate a proxy tier in front of Jetty, treat this as a prompt to re-review your end-to-end HTTP/1.1 parsing assumptions (especially around Transfer-Encoding: chunked handling and any “normalize/parse/forward” transformations) and add targeted regression tests for desync behavior in staging.
• If compromise/abuse is suspected, review reverse-proxy and application logs for anomalous request framing (chunked bodies with unusual chunk extensions) and investigate for signs of cache poisoning or cross-user response mixups.