CVE-2026-19203 is an HTTP request smuggling vulnerability in Eclipse Jetty caused by inconsistent parsing of HTTP/1.1 chunked requests. Specifically, Jetty accepts a lone LF character as a terminator in parts of chunked request parsing, which can cause Jetty and intermediary proxies to disagree on request boundaries. This behavior varies depending on Jetty version and HTTP compliance mode configuration, potentially occurring in chunk extensions, chunk data termination, or trailer termination. This inconsistency can be exploited to smuggle HTTP requests, impacting the integrity of HTTP communications.

The vulnerability allows an attacker to craft HTTP/1.1 chunked requests that are interpreted differently by Jetty and intermediary proxies, potentially enabling HTTP request smuggling attacks. Such attacks can lead to unauthorized request manipulation, bypassing security controls, or interfering with HTTP traffic processing. The CVSS score of 8.3 indicates a high severity impact with network attack vector, low attack complexity, and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor Eclipse Foundation advisories for updates and consider configuring HTTP compliance modes cautiously to mitigate risk until a fix is available.