CVE-2026-12606

MEDIUM

Eclipse GlassFish - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Title source: rule

Description

Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to "true".

References (1)

Core 1

Core References

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/129

Scores

CVSS v3 5.3

EPSS 0.0019

EPSS Percentile 8.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-444

Status published

Products (3)

eclipse/grizzly 4.0.0 - 4.0.2

Eclipse Foundation/Eclipse GlassFish 4.0.0 - 4.0.2

Eclipse Foundation/Eclipse GlassFish 5.0.0 - 5.0.2

Published Jul 14, 2026

Tracked Since Jul 14, 2026