The vulnerability CVE-2026-2332 in Eclipse Jetty arises from the HTTP/1.1 parser's mishandling of chunk extensions in chunked transfer encoding. Specifically, the parser terminates chunk extension parsing at a CRLF inside quoted strings rather than treating this as an error, allowing an attacker to craft chunked requests with unterminated quoted strings in chunk extensions. This enables HTTP request smuggling attacks by injecting additional HTTP requests within the body of a legitimate request. The flaw is similar to the "funky chunks" techniques documented in external research. Affected versions include Eclipse Jetty versions >=4.18 and <4.18.1, 9.4.0, 10.0.0, 11.0.0, 12.0.0, and 12.1.0, as well as Red Hat builds incorporating these versions. Red Hat has issued security advisories and updates to mitigate this vulnerability.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to perform HTTP request smuggling, which can lead to bypassing security controls, request/response desynchronization, and potentially unauthorized access or manipulation of HTTP traffic. The CVSS v3.1 base score is 7.4 (High), reflecting network attack vector, high impact on confidentiality and integrity, and no user interaction required. There are no known exploits in the wild at this time.

Red Hat has released security updates addressing this vulnerability in their Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 (RHBQ 3.33.1.GA) and related products. Users should apply these official updates to remediate the issue. Before applying updates, back up existing installations and configurations. Patch status is confirmed by Red Hat advisories. No alternative mitigations are specified in the vendor advisory.