CVE-2026-2332: Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

April 14, 2026

Request Smuggling: Attacker injects arbitrary HTTP requests
Cache Poisoning: Smuggled responses poison shared caches
Access Control Bypass: Smuggled requests bypass frontend security
Session Hijacking: Smuggled requests can steal other users’ responses

References

github.com/advisories/GHSA-355h-qmc2-wpwf
github.com/jetty/jetty.project
github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf
gitlab.eclipse.org/security/cve-assignment/-/issues/89
nvd.nist.gov/vuln/detail/CVE-2026-2332
w4ke.info/2025/06/18/funky-chunks.html

Code Behaviors & Features

Detect and mitigate CVE-2026-2332 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →