p PatchFirst

CVE-2026-19203

CVE-2026-19203

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.

CVSS 8.3 · High · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • eclipse jetty

    Versions
    • ≥ 12.1.0, ≤ 12.1.11: Affected (semver)
    • ≥ 12.0.0, ≤ 12.0.37: Affected (semver)
    • ≥ 11.0.0, ≤ 11.0.31: Affected (semver)
    • ≥ 10.0.0, ≤ 10.0.31: Affected (semver)
    • ≥ 9.4.0, ≤ 9.4.63: Affected (semver)

    No fix published

  • jetty12 Debian:13

    Versions
    • 12.0.17-3
    • 12.0.17-3.1
    • 12.0.17-3.1~deb13u1
    • 12.0.32-1
    • 12.0.32-2
    • 12.0.33-1
    • 12.0.39-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty12 Debian:14

    Versions
    • 12.0.17-3
    • 12.0.17-3.1
    • 12.0.17-3.1~deb13u1
    • 12.0.32-1
    • 12.0.32-2
    • 12.0.33-1
    • 12.0.39-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Debian:12

    Versions
    • 9.4.50-4
    • 9.4.50-4+deb12u1
    • 9.4.50-4+deb12u2
    • 9.4.50-4+deb12u3
    • 9.4.51-1
    • 9.4.51-2
    • 9.4.52-1
    • 9.4.53-1
    • 9.4.54-1
    • 9.4.55-1
    • 9.4.56-1
    • 9.4.57-0+deb12u1
    • 9.4.57-1
    • 9.4.57-1.1
    • 9.4.57-1.1~deb12u1
    • 9.4.57-1.1~deb13u1
    • 9.4.58-1
    • 9.4.58-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Debian:13

    Versions
    • 9.4.57-1
    • 9.4.57-1.1
    • 9.4.57-1.1~deb12u1
    • 9.4.57-1.1~deb13u1
    • 9.4.58-1
    • 9.4.58-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Debian:14

    Versions
    • 9.4.57-1
    • 9.4.57-1.1
    • 9.4.57-1.1~deb12u1
    • 9.4.57-1.1~deb13u1
    • 9.4.58-1
    • 9.4.58-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty Ubuntu:14.04:LTS

    Versions
    • 6.1.26-1ubuntu1
    • 6.1.26-1ubuntu1.1
    • 6.1.26-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty Ubuntu:16.04:LTS

    Versions
    • 6.1.26-5
    • 6.1.26-5ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:16.04:LTS

    Versions
    • 9.2.14-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:18.04:LTS

    Versions
    • 9.2.22-2
    • 9.2.22-3
    • 9.2.23-1
    • 9.4.15-1~18.04.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:20.04:LTS

    Versions
    • 9.4.18-2build2
    • 9.4.26-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:22.04:LTS

    Versions
    • 9.4.39-3
    • 9.4.44-2
    • 9.4.44-3
    • 9.4.44-4
    • 9.4.45-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:24.04:LTS

    Versions
    • 9.4.51-2
    • 9.4.53-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty12 Ubuntu:26.10

    Versions
    • 12.0.32-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:26.10

    Versions
    • 9.4.58-1
    • 9.4.58-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty12 Ubuntu:26.04:LTS

    Versions
    • 12.0.17-3.1
    • 12.0.32-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:26.04:LTS

    Versions
    • 9.4.57-1
    • 9.4.57-1.1
    • 9.4.58-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →