Eclipse GlassFish uses Eclipse Grizzly for HTTP processing. Versions 4.0.0 and 5.0.0 of Eclipse GlassFish contain a vulnerability (CVE-2026-12606) due to improper parsing of the trailer section in malformed trailer headers by Eclipse Grizzly before version 5.0.2. This parsing inconsistency can be leveraged to conduct HTTP request smuggling attacks, which may allow an attacker to interfere with the processing of HTTP requests. The vulnerability is categorized under CWE-444 (Inconsistent Interpretation of HTTP Requests).

Successful exploitation of this vulnerability could allow an attacker to perform HTTP request smuggling, potentially leading to request hijacking, bypassing security controls, or interfering with HTTP request processing. The CVSS 4.0 score of 6.3 indicates a medium severity impact with network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on integrity. There are no known exploits in the wild at this time.

No official patch or remediation level has been announced by the vendor as of the publication date. Users should monitor the Eclipse Foundation advisories for updates and apply any forthcoming patches promptly. Until a fix is available, consider implementing network-level protections such as web application firewalls that can detect and block malformed HTTP requests to mitigate potential exploitation.