GCVE-110-NCSC-2026-311

Advisory PublishedCVSS 8.1/10

Vulnetix · Advisory published August 19, 2026

Eclipse Jetty's HTTP/1.1 parser improperly handles unclosed quoted strings in chunked transfer encoding extensions, enabling request smuggling attacks that can lead to security bypass, cache poisoning, and unauthorized access.

Download JSON Open in Console

Weaknesses (CWE)

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')CWE-116Improper Encoding or Escaping of Output

Risk Scores

CVSS 3.1

8.1/10

High · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Oracle Corporation	vers:unknown/*	—	—
Oracle	vers:unknown/*	—	—

Aliases

CVE-2026-2332 CVE-2026-34481 CVE-2026-60822 CVE-2026-61284 CVE-2026-61286 CVE-2026-61298 CVE-2026-61300 CVE-2026-70684 CVE-2026-70737

References

advisory

Browse GCVE Records

1,895 records in the GCVE database · Updated September 4, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON