CVE-2026-19203: Jetty HTTP Request Smuggling Vulnerability

CVE-2026-19203 Overview

CVE-2026-19203 is an HTTP request smuggling vulnerability in the Eclipse Jetty web server. The flaw exists in how Jetty parses HTTP/1.1 chunked transfer-encoding requests. Jetty accepts a lone line-feed (LF) character as a terminator in parts of chunked request parsing, while upstream proxies typically require a full carriage-return line-feed (CRLF) sequence. This parser disagreement lets a client craft requests that Jetty and an intermediary interpret with different boundaries. The mismatch enables classic HTTP request smuggling against Jetty deployments sitting behind a reverse proxy. Depending on Jetty version and configured HTTP compliance mode, the desynchronization can occur in chunk extensions, chunk data termination, or trailer termination. The issue is tracked under [CWE-444] (Inconsistent Interpretation of HTTP Requests).

Critical Impact
Remote attackers can smuggle HTTP requests through fronting proxies to bypass access controls, poison caches, and hijack sessions of legitimate users.

Affected Products

Eclipse Jetty web server (see the GitHub Security Advisory for affected version ranges)
Jetty deployments configured with permissive HTTP compliance modes
Applications fronted by intermediary proxies or load balancers that speak HTTP/1.1 to Jetty

Discovery Timeline

2026-09-08 - CVE-2026-19203 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-19203

Vulnerability Analysis

CVE-2026-19203 is an HTTP request smuggling vulnerability rooted in inconsistent parsing of the HTTP/1.1 chunked transfer encoding. RFC 9112 requires each chunk header, chunk body, and trailer section in a chunked message to be delimited by a CRLF (\r\n) sequence. Jetty relaxes this requirement and accepts a bare LF (\n) as a valid terminator in several positions of the chunked grammar.

When Jetty sits behind a reverse proxy, load balancer, or content delivery network that strictly enforces CRLF, the two servers disagree about where one request ends and the next begins. An attacker exploits that disagreement to prepend attacker-controlled bytes onto a subsequent victim request. This is a CL.TE or TE.TE smuggling pattern, depending on the fronting device.

Successful exploitation lets attackers bypass front-end authentication and access controls, poison web and proxy caches, capture credentials or session tokens from other users, and route requests to internal endpoints that should not be reachable.

Root Cause

The root cause is over-permissive termination handling in Jetty's HTTP/1.1 chunked parser. Depending on Jetty version and the active HTTP compliance mode, the parser accepts a lone LF as a terminator inside chunk extensions, at the end of chunk data, or at the end of the trailer section. RFC-compliant intermediaries treat those same bytes as part of the message body or as malformed, producing the desynchronization required for smuggling.

Attack Vector

The attack is remote and unauthenticated over the network. An attacker sends a single crafted HTTP/1.1 request containing chunked encoding with lone LF terminators in a position that Jetty accepts but the upstream proxy does not. No user interaction and no elevated privileges are required. The vulnerability requires Jetty to be deployed behind an HTTP/1.1 intermediary for the smuggling primitive to have impact. Technical details on the specific chunked grammar positions are documented in the Jetty GitHub Security Advisory.

Detection Methods for CVE-2026-19203

Indicators of Compromise

HTTP/1.1 requests containing chunked bodies where chunk-size lines, chunk data, or trailers are terminated with a bare LF (0x0A) instead of CRLF (0x0D 0x0A).
Unexpected pairing of request methods and URIs in Jetty access logs, such as a POST immediately followed by a request whose path appears prepended with body data.
Proxy and Jetty logs showing different Content-Length or Transfer-Encoding interpretations for the same connection.
Response-splitting artifacts where users receive responses intended for other sessions.

Detection Strategies

Deploy web application firewall rules that reject chunked messages containing bare LF terminators or ambiguous Transfer-Encoding headers.
Correlate request identifiers between the fronting proxy and Jetty to surface request-count mismatches on a single TCP connection.
Hunt access logs for anomalous request sequences, oversized chunk extensions, and unexpected trailer fields.
Run automated smuggling probes such as HTTP Request Smuggler against staging environments to confirm parser alignment.

Monitoring Recommendations

Forward Jetty and reverse-proxy access logs into a centralized analytics platform and alert on request-boundary discrepancies.
Monitor for spikes in 400 Bad Request responses from Jetty following chunked POST traffic.
Track authentication and session-token reuse from unexpected client IP addresses that may indicate hijacked victim requests.

How to Mitigate CVE-2026-19203

Immediate Actions Required

Upgrade Jetty to the fixed release identified in the Jetty GitHub Security Advisory GHSA-xc35-c22g-239h.
Inventory all Jetty instances, including embedded deployments inside Java applications, and prioritize those exposed behind HTTP/1.1 intermediaries.
Set Jetty's HTTP compliance mode to the strictest option supported by your version to reject bare-LF terminators in chunked requests.
Configure fronting proxies to normalize or reject non-RFC-compliant chunked encoding before requests reach Jetty.

Patch Information

Eclipse has published fixed Jetty releases that require CRLF terminators throughout chunked request parsing. Refer to the Jetty Security Advisory for the specific patched versions and upgrade guidance. Apply the update to all Jetty deployments, including those bundled inside third-party Java applications and container images.

Workarounds

Terminate HTTP/1.1 at a proxy that strictly enforces RFC 9112 chunked framing and rejects bare-LF terminators.
Force HTTP/2 end-to-end between clients and Jetty where possible, eliminating the HTTP/1.1 chunked parsing path.
Disable Transfer-Encoding: chunked at the edge for endpoints that do not require streaming request bodies.
Deploy WAF signatures that block chunked requests containing \n outside of chunk data payloads.

bash

# Configuration example
# Refer to the Jetty Security Advisory for exact configuration guidance:
# https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h