CVE-2026-12606: Eclipse Grizzly HTTP Smuggling Vulnerability

CVE-2026-12606 Overview

CVE-2026-12606 is an HTTP request smuggling vulnerability in Eclipse Grizzly, a Java network framework used to build scalable server applications. Versions before 5.0.2 fail to properly parse the trailer section when a malformed trailer header line is present in an HTTP request. Attackers can leverage this parsing weakness to smuggle a second request past front-end proxies or load balancers into the back-end Grizzly server. The flaw is tracked under CWE-444, Inconsistent Interpretation of HTTP Requests. The issue is remotely exploitable without authentication or user interaction over the network.

Critical Impact
Request smuggling against Eclipse Grizzly can bypass front-end security controls, poison caches, hijack user sessions, and expose internal endpoints that were assumed to be protected by an upstream proxy.

Affected Products

Eclipse Grizzly versions prior to 5.0.2
Java applications and services embedding vulnerable Grizzly HTTP server components
Middleware and REST frameworks built on top of Grizzly (for example, Jersey containers using the Grizzly connector)

Discovery Timeline

2026-07-14 - CVE-2026-12606 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-12606

Vulnerability Analysis

HTTP request smuggling arises when two HTTP processors in a chain, typically a front-end proxy and a back-end origin server, disagree on where one request ends and the next begins. In this case, Eclipse Grizzly mishandles the trailer section of a chunked HTTP message when a trailer header line is malformed. Trailers are optional headers that follow the final chunk of a Transfer-Encoding: chunked body and are permitted by RFC 9112. An attacker can craft a message where the front-end accepts the trailers as terminating the request while Grizzly interprets part of the trailer content as the start of a new, smuggled request. The smuggled request is then processed with the trust context of the shared connection.

Root Cause

The root cause is improper parsing of trailer header lines in Grizzly's HTTP codec. The parser does not enforce strict validation of trailer syntax, so malformed lines are not rejected outright. Instead, the remaining bytes are left in the connection buffer and reinterpreted as a subsequent request, producing the desynchronization required for smuggling.

Attack Vector

Exploitation requires only network access to a service that terminates or forwards HTTP traffic to a vulnerable Grizzly instance. The attacker sends a single crafted chunked request that includes a malformed trailer header. When Grizzly sits behind a reverse proxy, cache, or load balancer, the smuggled request can be used to poison the shared cache, bypass authentication filters, capture another user's request, or reach administrative endpoints. Technical details are available in the Eclipse CVE Assignment Work Item.

Detection Methods for CVE-2026-12606

Indicators of Compromise

HTTP requests containing Transfer-Encoding: chunked with malformed trailer header lines that do not conform to the field-name: field-value grammar.
Access log entries showing unexpected request methods, paths, or Host headers appearing to originate from a front-end proxy IP.
Responses served from cache that do not match the requesting client's request URI or session context.

Detection Strategies

Inspect traffic between reverse proxies and Grizzly back-ends for chunked messages that include trailer sections, and flag any trailer line missing a colon or containing control characters.
Correlate front-end and back-end access logs to identify request-count mismatches on the same keep-alive connection, a strong signal of desynchronization.
Deploy web application firewall rules that reject requests combining Transfer-Encoding: chunked with ambiguous framing or malformed trailers.

Monitoring Recommendations

Track the version of Eclipse Grizzly reported by application dependency scanners and alert on any instance below 5.0.2.
Monitor for spikes in 400 Bad Request responses from Grizzly, which may indicate probing for parser edge cases.
Enable verbose HTTP parser logging in non-production environments to capture malformed trailer parsing events during testing.

How to Mitigate CVE-2026-12606

Immediate Actions Required

Upgrade Eclipse Grizzly to version 5.0.2 or later across all application deployments and container images.
Audit application dependencies, including transitive dependencies via frameworks such as Jersey, to identify embedded Grizzly versions.
Enforce strict HTTP parsing on any front-end proxy or WAF that fronts Grizzly, rejecting requests with malformed chunked trailers.

Patch Information

The vendor fix is included in Eclipse Grizzly 5.0.2. Consult the Eclipse CVE Assignment Work Item for the coordinated advisory and links to upstream commits. No vendor advisory URL beyond the Eclipse work item is provided in the CVE record.

Workarounds

If immediate patching is not possible, terminate HTTP at a strict, standards-compliant reverse proxy that normalizes or strips trailer sections before forwarding to Grizzly.
Disable HTTP keep-alive between the front-end proxy and Grizzly so that each request uses a fresh TCP connection, which prevents smuggled requests from being appended to a shared connection.
Configure the front-end to reject any request that combines Transfer-Encoding: chunked with trailer headers if the application does not require them.

bash

# Example: Update Maven dependency to the patched Grizzly release
# pom.xml
# <dependency>
#   <groupId>org.glassfish.grizzly</groupId>
#   <artifactId>grizzly-http-server</artifactId>
#   <version>5.0.2</version>
# </dependency>

mvn versions:set-property -Dproperty=grizzly.version -DnewVersion=5.0.2
mvn dependency:tree | grep grizzly