Eclipse Jetty's HTTP/1.1 parser is vulnerable to HTTP request smuggling due to improper parsing of chunk extensions in chunked transfer encoding. The parser terminates chunk extension parsing at a CRLF sequence inside quoted strings instead of treating this as an error, allowing an attacker to craft specially formed HTTP requests with unterminated quoted chunk extensions. This can result in injection of smuggled HTTP requests that bypass normal request boundaries. The vulnerability is tracked as CWE-444 (Inconsistent Interpretation of HTTP Requests) and affects multiple Jetty versions from 9.4.0 through 12.1.0. The CVSS 3.1 score is 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating network attack vector with high confidentiality and integrity impact but no availability impact. Red Hat has issued security advisories and updates to address this issue in their distributions.

Successful exploitation of this vulnerability can allow an attacker to smuggle HTTP requests through the Jetty server, potentially leading to unauthorized access, data disclosure, or manipulation of HTTP requests and responses. The CVSS score reflects high impact on confidentiality and integrity, meaning sensitive data could be exposed or altered. There is no reported impact on availability. No known exploits in the wild have been reported so far.

Red Hat has published security advisories and released updated packages that fix this vulnerability. Users of affected Jetty versions should apply the official patches or updates provided by their vendor or distribution. Since no official fix or patch link is directly provided in the input data, users should consult the Red Hat advisories at https://access.redhat.com/security/cve/CVE-2026-2332 and corresponding errata for detailed remediation instructions. Patch status is not yet confirmed beyond these advisories; check vendor advisories regularly for updates. There are no indications that this vulnerability is mitigated by default or requires no action.