CVE-2026-19203CWE-444

CVE-2026-19203

published September 8, 2026

CVSS
8.3
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.

This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.

The record
Technical detail
CVSS
8.3 · NONE
CVSS v4.0
8.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00306 · 22.1th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2026-09-08T17:17Z
References (1)
https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h · [email protected]
EPSS history
Timeline
  • 10 SEP 03:16Z
    EPSS moved — → 0%
    epss
  • 08 SEP 12:08Z
    A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request…
    cvelistv5