In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html
* https://w4ke.info/2025/10/29/funky-chunks-2.html
Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error.
POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked
1;ext="val X 0
GET /smuggled HTTP/1.1 ...
Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jmc | Jul 2, 2026 | May 26, 2026 |
| Redhat_linux | — | Upgrade jmc | May 27, 2026 | Apr 14, 2026 |
| Rocky_linux | — | Upgrade jmc | Jun 1, 2026 | May 30, 2026 |
| Suse | — | Upgrade jetty-serverUpgrade jetty-util-ajaxUpgrade jetty-utilUpgrade jetty-servletUpgrade jetty-ioUpgrade jetty-securityUpgrade jetty-http | May 8, 2026 | May 8, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub