CVE-2026-19203
Fixed in a distro release EPSS <1%CVSS 8.3
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.
Products: Eclipse Foundation Eclipse Jetty
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cruise-control-fips-jars | no fix |
| Chainguard | cruise-control-jars | no fix |
| Chainguard | kafka-3.7 | no fix |
| Chainguard | kafka-3.8 | no fix |
| Chainguard | kafka-3.9 | no fix |
| Chainguard | kafka-4.0 | 4.0.2-r16 |
| Chainguard | kafka-4.1 | 4.1.2-r13 |
| Chainguard | kafka-4.2 | 4.2.2-r4 |
| Chainguard | kafka-4.3-openjdk-17 | 4.3.1-r13 |
| Chainguard | kafka-4.3-openjdk-21 | 4.3.1-r13 |
| Chainguard | kafka-4.3-openjdk-25 | 4.3.1-r13 |
| Chainguard | kafka-fips-4.1 | 4.1.2-r15 |
| Chainguard | kafka-fips-4.2 | 4.2.2-r3 |
| Chainguard | kafka-fips-4.3 | 4.3.1-r11 |
| Chainguard | strimzi-kafka-operator-cluster-operator | 1.2.0-r11 |
| Chainguard | strimzi-kafka-operator-fips-cluster-operator | 1.2.0-r9 |
| Chainguard | strimzi-kafka-operator-fips-kafka-agent | 1.2.0-r9 |
| Chainguard | strimzi-kafka-operator-fips-kafka-init | 1.2.0-r9 |
| Chainguard | strimzi-kafka-operator-fips-kafka-thirdparty-libs-cc | no fix |
| Chainguard | strimzi-kafka-operator-fips-topic-operator | 1.2.0-r9 |
| Chainguard | strimzi-kafka-operator-fips-tracing-agent | 1.2.0-r9 |
| Chainguard | strimzi-kafka-operator-fips-user-operator | 1.2.0-r9 |
| Chainguard | strimzi-kafka-operator-kafka-agent | 1.2.0-r11 |
| Chainguard | strimzi-kafka-operator-kafka-init | 1.2.0-r11 |
| Chainguard | strimzi-kafka-operator-kafka-thirdparty-libs-cc | no fix |
| Chainguard | strimzi-kafka-operator-topic-operator | 1.2.0-r11 |
| Chainguard | strimzi-kafka-operator-tracing-agent | 1.2.0-r11 |
| Chainguard | strimzi-kafka-operator-user-operator | 1.2.0-r11 |
| Debian 12 | jetty9 | no fix |
| Debian 13 | jetty12 | no fix |
| Debian 13 | jetty9 | no fix |
| Debian 14 | jetty12 | no fix |
| Debian 14 | jetty9 | no fix |
| Ubuntu 14.04 LTS | jetty | no fix |
| Ubuntu 16.04 LTS | jetty | no fix |
| Ubuntu 16.04 LTS | jetty9 | no fix |
| Ubuntu 18.04 LTS | jetty9 | no fix |
| Ubuntu 20.04 LTS | jetty9 | no fix |
| Ubuntu 22.04 LTS | jetty9 | no fix |
| Ubuntu 24.04 LTS | jetty9 | no fix |
| Ubuntu 26.04 LTS | jetty12 | no fix |
| Ubuntu 26.04 LTS | jetty9 | no fix |
| Ubuntu 26.10 | jetty12 | no fix |
| Ubuntu 26.10 | jetty9 | no fix |
| Wolfi | kafka-4.1 | 4.1.2-r13 |
| Wolfi | kafka-4.2 | 4.2.2-r4 |
| Wolfi | strimzi-kafka-operator-cluster-operator | 1.2.0-r11 |
| Wolfi | strimzi-kafka-operator-kafka-agent | 1.2.0-r11 |
| Wolfi | strimzi-kafka-operator-kafka-init | 1.2.0-r11 |
| Wolfi | strimzi-kafka-operator-kafka-thirdparty-libs-cc | no fix |
| Wolfi | strimzi-kafka-operator-topic-operator | 1.2.0-r11 |
| Wolfi | strimzi-kafka-operator-tracing-agent | 1.2.0-r11 |
| Wolfi | strimzi-kafka-operator-user-operator | 1.2.0-r11 |