CVE-2026-19203

Severity: high (CVSS 8.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-08 · updated 2026-09-08
Weakness: CWE-444

Description

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.

Affected products

The Eclipse Foundation Eclipse Jetty: from 12.1.0 through 12.1.11; from 12.0.0 through 12.0.37; from 11.0.0 through 11.0.31; from 10.0.0 through 10.0.31; from 9.4.0 through 9.4.63

References

https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h

Get alerted when CVE-2026-19203 or the next vulnerability affects your stack