CVE detail
CVE-2026-2332
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 27.1 · diversity 19.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 1
- within the 30d window
- Peak daily
- 1
- highest bucket
Evidence
Source links by recency
14 source links · newest first
y. Two critical flaws in Oracle Database Server The most severe flaw Oracle patched in its flagship database product is CVE-2026-61211, a vulnerability in the RDBMS component’s DBMS_CLOUD package with a CVSS score of 9.9. This easily exploitable vulnerability allows a low-privileged attacker having Execute DBMS_CLOUD privilege with network access via O
newswww.csoonline.comJul 22, 2026, 6:14 PMOracle has released the first security fixes in its new monthly Critical Security Patch Update (CSPU) cycle, designed to address urgent vulnerabilities that can’t wait for the company’s quarterly patching. The initial batch addresses 35 flaws, including several for which exploit code is publicly available. In total, there are 11 flaws rated ‘critical’, 18 rated […]
newswww.csoonline.comJun 1, 2026, 5:57 PM- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comApr 14, 2026, 12:16 PM - https://bugzilla.redhat.com/show_bug.cgi?id=2458187bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comApr 14, 2026, 12:16 PM - https://access.redhat.com/security/cve/CVE-2026-2332access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 14, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:25089access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 14, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:22453access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 14, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:21773access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 14, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:20568access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 14, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:17668access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 14, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:14272access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 14, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:10175access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comApr 14, 2026, 12:16 PM - https://gitlab.eclipse.org/security/cve-assignment/-/issues/89gitlab.eclipse.org
No excerpt available.
Exploitgitlab.eclipse.orgApr 14, 2026, 12:16 PM No excerpt available.
Exploitgithub.comApr 14, 2026, 12:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2017-7658CVSS 9.8 · Critical
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths header…
- CVE-2017-7657CVSS 9.8 · Critical
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled…
- CVE-2017-7656CVSS 7.5 · High
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/…
- CVE-2026-58155CVSS 9.2 · Critical
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 throu…
- CVE-2026-58153CVSS 6.3 · Medium
Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Server:…
- CVE-2026-58150CVSS 7.8 · High
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1…