CVE-2026-19203

Eclipse Jetty mishandles HTTP/1.1 chunked request framing by accepting a lone LF character as a line terminator in parts of chunked parsing, which may occur in chunk extensions, chunk-data termination, or trailer termination depending on the Jetty version and configured HTTP compliance mode. An attacker can send specially crafted chunked requests that cause Jetty and a fronting intermediary proxy to disagree on where a request begins and ends, enabling HTTP request smuggling (CWE-444). Successful smuggling can let an attacker slip requests past front-line controls, poison caches, or hijack other users' requests; the CVSS 4.0 vector reflects low confidentiality impact but high integrity impact. Affected deployments are those in which a Jetty server receives HTTP/1.1 chunked requests through an intermediary proxy that interprets the framing differently; the available data does not specify exact affected version ranges, and exposure depends on version and compliance mode. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade Jetty to the patched release identified in the Eclipse security advisory (exact fixed version numbers are not provided in this data), and configure the HTTP compliance mode to enforce strict CRLF termination for chunk extensions, chunk data, and trailers. If Jetty sits behind an intermediary (reverse proxy, load balancer, or CDN), verify that the intermediary rejects bare-LF chunked framing or align both components to the same strict RFC 7230 parsing; Jetty instances that are directly internet-exposed with no intermediary are largely unaffected. Given the modest EPSS (0.3%) and no known PoC, prioritize patching internet-facing proxy-fronted deployments but monitor for emerging exploit details.