Eclipse Jetty versions 9.4.0, 10.0.0, 11.0.0, 12.0.0, and 12.1.0 contain a vulnerability in their HTTP/1.1 parser related to improper handling of chunk extensions. Specifically, the parser terminates chunk extension parsing at a CRLF inside quoted strings instead of treating this as an error, allowing an attacker to craft HTTP requests with unclosed double quotes in chunk extensions. This enables HTTP request smuggling attacks that can bypass security controls, cause cache poisoning, or allow unauthorized endpoint access. The vulnerability is tracked as CWE-444 and has a CVSS v3.1 score of 7.4 (high severity). Red Hat advisory confirms the issue and recommends updating affected packages as no practical mitigation exists. The vulnerability affects Jetty servers behind reverse proxies or load balancers.

Successful exploitation allows attackers to bypass security controls, poison web caches, and gain unauthorized access to endpoints by injecting smuggled HTTP requests. This can compromise confidentiality and integrity of web applications relying on Jetty. The vulnerability does not impact availability. The CVSS score of 7.4 reflects high confidentiality and integrity impact with network attack vector and no privileges required.

Red Hat and Eclipse recommend updating to patched versions of Eclipse Jetty as soon as possible. No practical mitigation or workaround has been identified. Users should apply vendor-provided updates promptly once available. Since this is not a cloud service, remediation depends on patching affected Jetty deployments.