# CVE-2026-19203

## Summary

- **CVE ID:** CVE-2026-19203
- **Severity:** HIGH
- **CVSS Score:** 8.3 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N)
- **CWE:** CWE-444
- **Published:** Sep 8, 2026
- **Last Modified:** Sep 8, 2026

## Description

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.




This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.

## Affected Products

- Eclipse Foundation — Eclipse Jetty (12.1.0)
- Eclipse Foundation — Eclipse Jetty (12.0.0)
- Eclipse Foundation — Eclipse Jetty (11.0.0)
- Eclipse Foundation — Eclipse Jetty (10.0.0)
- Eclipse Foundation — Eclipse Jetty (9.4.0)

## References

- [CNA](https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.29%
- **EPSS Percentile:** 21.3

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._