RHLW-2026-C317E2781FF17B2F Lightwell Security Advisory: jetty-http 12.0.32.rhlw-00002

Red Hat Lightwell has released org.eclipse.jetty:jetty-http 12.0.32.rhlw-00002 with a backported security fix. CVE-2026-2332: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing This patched artifact is a drop-in replacement for org.eclipse.jetty:jetty-http 12.0.32 from Maven Centr...

Security Bulletin: Due to the use of HTTP/1.1 with Jetty server, IBM Sterling Control Center is vulnerable to Inconsistent Interpretation of HTTP Requests (CVE-2026-19203)

Summary HTTP/1.1 with Jetty server is used by IBM Sterling Control Center as part of dependency in jetty-http-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-19203 DESCRIPTION: A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary...

ROOT-APP-MAVEN-CVE-2026-2332 CVE-2026-2332 in org.eclipse.jetty:jetty-http - Patched by Root

Root has patched CVE-2026-2332 in the org.eclipse.jetty:jetty-http package for Root:Maven. Multiple fixed versions available...

Rocky Linux 9 [CIQ] Security Update: jmc Multiple Vulnerabilities (crlsa-2026_20568)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202620568 advisory. lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing CVE-2025-66566 org.eclipse.jetty/jetty-http: HTTP request smuggling via...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime due to a race condition in the server when handling RSTSTREAM and GOAWAY frames. An attacker can cause the server to become unresponsive by sending specially crafted HTTP/2 requests...

HTTP Request Smuggling

Overview org.eclipse.jetty:jetty-http is an is a http module for jetty server. Affected versions of this package are vulnerable to HTTP Request Smuggling in the chunked request parsing of HttpParser, which accepts a lone LF, rather than CRLF, as the line terminator for chunk extensions, chunk dat...

ai.covia:covia-python-adapter (>=0.8.0, <=0.9.1), ai.covia:covia-sql (>=0.6.0, <=0.9.1) +2288 more potentially affected by CVE-2026-19203 via org.eclipse.jetty:jetty-http (>=12.1.0.alpha0, <=12.1.11)

org.eclipse.jetty:jetty-http MAVEN version =12.1.0.alpha0, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =0.1.7, =4.13.5, =4.9.0, =2.2.3, =3.30.0, =3.30.0, =3.30.0, =3.30.3 and more Source cves: CVE-2026-19203 Source advisory: SNYK:JAVA-ORGECLIPSEJETTY-19644207...

CVE-2026-12611

CVE-2026-12611 affects the Eclipse Jetty HTTP/2 server implementation. A client can trigger a race condition in the server's handling of RST_STREAM and GOAWAY frames, which resets HTTP2Flusher.terminated back to null. This allows flusher entries to be enqueued that are never processed, leaving wr...

CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

ROOT-APP-MAVEN-CVE-2024-6763 CVE-2024-6763 in org.eclipse.jetty:jetty-http - Patched by Root

Root has patched CVE-2024-6763 in the org.eclipse.jetty:jetty-http package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-11143 CVE-2025-11143 in org.eclipse.jetty:jetty-http - Patched by Root

Root has patched CVE-2025-11143 in the org.eclipse.jetty:jetty-http package for Root:Maven. Multiple fixed versions available...

Inconsistent Interpretation of HTTP Requests at org.eclipse.jetty:jetty-http dependency in Crucible Server

This is a vulnerability in a non-Atlassian Crucible Server dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Inconsistent Interpretation of HTTP Requests vulnerability was introduced in version 4.9.0 of Crucible Server. Thi...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to CVE-2026-2332.

Summary IBM Maximo Application Suite - IoT Component uses jetty-http-10.0.26.jar, jetty-http-12.1.5.jar, jetty-http-12.1.6.jar which is vulnerable to CVE-2026-2332. This bulletin contains information regarding the vulnerability and how to address it. Vulnerability Details CVEID:CVE-2026-2332...

Improper Authentication

Jetty HTTP Client is vulnerable to Improper Authentication. The vulnerability is due to the use of ISO-8859-1 encoding when computing Digest authentication response hashes, which replaces all non-Latin-1 characters with ?, allowing an attacker who knows a victim's username to bypass Digest...

PT-2026-53080

Root has patched GHSA-wjpw-4j6x-6rwh in the io.root.org.eclipse.jetty:jetty-http package for Root:Maven. Multiple fixed versions available...

jmc security update

An update is available for jmc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list JDK Mission Control is a powerful profiler for HotSpot JVMs and has an advanced s...

RockyLinux 9 : jmc (RLSA-2026:20568)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:20568 advisory. lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing CVE-2025-66566 org.eclipse.jetty/jetty-http: HTTP request smuggling v...

Vulnerabilities in Oracle Database Server

Oracle has identified vulnerabilities in Oracle REST Data Services versions 24.2.0 to 26.1.0 and Oracle Database Server versions 23.4.0 to 23.26.2. The vulnerabilities in Oracle REST Data Services allow attackers with low privileges and network access via HTTPS to perform various actions without...

Important: Red Hat Security Advisory: jmc security update

An update for jmc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in jetty-http (CVE-2025-11143)

Summary IBM Sterling Control Center is affected by a vulnerability CVE-2025-11143 reported for jetty-http-12.0.25.jar. Vulnerability Details CVEID:CVE-2025-11143 DESCRIPTION: The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differentia...