Към съдържанието
Търсене

CVE-2026-2332: Eclipse Foundation Eclipse Jetty, друго

7.4

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, при специфични условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: има публичен пример за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

Засегнати продукти

  • Eclipse Foundation Eclipse Jetty: 12.1.0 до 12.1.6; 12.0.0 до 12.0.32; 11.0.0 до 11.0.28; 10.0.0 до 10.0.27; 9.4.0 до 9.4.59
  • Red Hat HawtIO HawtIO 4.4.0
  • Red Hat Red Hat AMQ Broker 7.13.5
  • Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
  • Red Hat Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
  • Red Hat Red Hat Enterprise Linux 9: 0:8.2.0-19.el9_8.2 преди *
  • Red Hat Red Hat Satellite 6.16 for RHEL 8: 0:8.14.1-1.el8sat преди *
  • Red Hat Red Hat Satellite 6.16 for RHEL 9: 0:8.14.1-1.el9sat преди *
  • Red Hat Red Hat Satellite 6.17 for RHEL 9: 0:8.14.1-1.el9sat преди *
  • Red Hat Red Hat Satellite 6.18 for RHEL 9: 0:8.14.1-1.el9sat преди *
  • Red Hat Red Hat Satellite 6.19 for RHEL 9: 0:8.14.1-1.el9sat преди *
  • Red Hat OpenShift Developer Tools and Services 4.12: 1786628667 преди *
  • Red Hat OpenShift Developer Tools and Services 4.13: 1786628681 преди *
  • Red Hat OpenShift Developer Tools and Services 4.14: 1786533561 преди *
  • Red Hat OpenShift Developer Tools and Services 4.15: 1786533565 преди *
  • Red Hat OpenShift Developer Tools and Services 4.16: 1787125166 преди *
  • Red Hat OpenShift Developer Tools and Services 4.17: 1787124635 преди *
  • Red Hat OpenShift Developer Tools and Services 4.18: 1787125069 преди *
  • Red Hat OpenShift Developer Tools and Services 4.19: 1787124632 преди *
  • Red Hat OpenShift Developer Tools and Services 4.20: 1787124925 преди *
  • Red Hat OpenShift Developer Tools and Services 4.21: 1787125311 преди *
  • Red Hat OpenShift Developer Tools and Services 4.22: 1787124779 преди *
  • Red Hat Red Hat Offline Knowledge Portal 1.2.12: 1779996999 преди *
  • Red Hat Red Hat OpenShift Dev Spaces 3.27: 1776716842 преди *
  • Red Hat OpenShift Developer Tools and Services
  • Red Hat Red Hat AMQ Broker 7
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apicurio Registry 2
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 2
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat JBoss Web Server 6
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat streams for Apache Kafka 2
  • Red Hat streams for Apache Kafka 3

Вид слабост

История

  • 14 април 2026 Публикувано

Други уязвимости в Eclipse Foundation Eclipse Jetty

Първоизточници

CVE-2026-2332: Eclipse Foundation Eclipse Jetty, друго | freedomonline.bg