CVE-2026-2332

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 7.4EPSS 1%

Published 2026-04-14Updated 2026-09-13

Media 201PoC

Vulnerability details

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CNAeclipse

EPSS score history

Sources

5 links

PoC links are not available for guest users. Login to view them.

CVEShield CVE Organization RedHat Vuln DB NVD Analysis The Hacker News

Profile

CVSS

7.4

EPSS

Published

2026-04-14

Updated

2026-09-13

CNA

eclipse

Vendors

Eclipse Foundation

1 product

CPEs

cpe:/a:redhat:enterprise_linux:9::crb

cpe:/a:redhat:apache_camel_hawtio:4.4::el9

cpe:/a:redhat:amq_broker:7.13

cpe:/a:redhat:apache_camel_quarkus:3.33

cpe:/a:redhat:offline_knowledge_portal:1.2::el9

cpe:/a:redhat:openshift_devspaces:3.27::el9

cpe:/a:redhat:apache_camel_spring_boot:4.18

cpe:/a:redhat:ocp_tools

cpe:/a:redhat:amq_broker:7

cpe:/a:redhat:camel_quarkus:3

cpe:/a:redhat:debezium:2

cpe:/a:redhat:debezium:3

cpe:/a:redhat:jboss_fuse:7

cpe:/a:redhat:jboss_enterprise_web_server:6

cpe:/a:redhat:satellite:6

cpe:/a:redhat:red_hat_single_sign_on:7

cpe:/a:redhat:amq_streams:2

cpe:/a:redhat:amq_streams:3

cpe:/a:redhat:service_registry:2

cpe:/a:redhat:apicurio_registry:3

cpe:/a:redhat:jboss_data_grid:8

cpe:/a:redhat:jboss_enterprise_application_platform:7

cpe:/a:redhat:jboss_enterprise_application_platform:8

cpe:/a:redhat:jbosseapxp

cpe:/a:redhat:jboss_enterprise_bpms_platform:7

cpe:/a:redhat:satellite:6.16::el8

cpe:/a:redhat:satellite_capsule:6.16::el8

cpe:/a:redhat:satellite:6.16::el9

cpe:/a:redhat:satellite_capsule:6.16::el9

cpe:/a:redhat:satellite:6.17::el9

cpe:/a:redhat:satellite_capsule:6.17::el9

cpe:/a:redhat:satellite:6.18::el9

cpe:/a:redhat:satellite_capsule:6.18::el9

cpe:/a:redhat:satellite:6.19::el9

cpe:/a:redhat:satellite_capsule:6.19::el9

cpe:/a:redhat:ocp_tools:4.12::el8

cpe:/a:redhat:ocp_tools:4.15::el8

cpe:/a:redhat:ocp_tools:4.16::el9

cpe:/a:redhat:ocp_tools:4.17::el9

cpe:/a:redhat:ocp_tools:4.18::el9

cpe:/a:redhat:ocp_tools:4.20::el9

cpe:/a:redhat:ocp_tools:4.21::el9

cpe:/a:redhat:ocp_tools:4.13::el8

cpe:/a:redhat:ocp_tools:4.14::el8

cpe:/a:redhat:ocp_tools:4.19::el9

cpe:/a:redhat:ocp_tools:4.22::el9

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated