CVE-2026-12606

Published Jul 14, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to "true".

Analysis

Technical impact

Eclipse Grizzly versions before 5.0.2 incorrectly parse the trailer section of malformed trailer headers, allowing an attacker to craft malicious HTTP requests that can be smuggled between legitimate requests. This flaw, identified as CWE-444, enables HTTP request smuggling against exposed GlassFish servers.

Affected Systems

Eclipse GlassFish deployments that use Eclipse Grizzly older than version 5.0.2 are affected. No specific sub‑versions beyond this threshold are listed.

Risk and Exploitability

The CVSS score is 6.3, indicating a medium impact, and the EPSS score is less than 1%, implying a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would involve sending crafted HTTP requests containing malformed trailer headers to GlassFish servers. The description does not specify any privileged access requirement.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Eclipse Foundation

Eclipse GlassFish

unaffected

Version	Status	Constraints
`4.0.0`	affected	≤ 4.0.2
`5.0.0`	affected	< 5.0.2

Configuration 1 [-]

OR	cpe:2.3:a:eclipse:grizzly::::::::
	cpe:2.3:a:eclipse:grizzly::::::::

No data.

Vendor Product Versions

Eclipse

Glassfish

Version	Status	Scheme	Platform
`[4.0.0,4.0.2]`	affected	semver	—
`[5.0.0,5.0.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Eclipse Grizzly to version 5.0.2 or later.
Apply any available Eclipse GlassFish security patches that incorporate the updated Grizzly library.
If upgrade is not feasible, enable strict trailer parsing by setting org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110=true and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110=true, or configure the server to reject HTTP requests containing trailer headers.

Generated by OpenCVE AI on August 4, 2026 at 07:21 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.297% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/129

History

Aug 4, 2026 7:45 AM Title updated View changes

Type	Values Removed	Values Added
Title	HTTP Request Smuggling via Malformed Trailer Header in Eclipse Grizzly

Jul 31, 2026 11:00 AM Title updated View changes

Type	Values Removed	Values Added
Title		HTTP Request Smuggling via Malformed Trailer Header in Eclipse Grizzly

Jul 27, 2026 12:45 PM Description updated View changes

Type	Values Removed	Values Added
Description	Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling.	Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to "true".

Jul 24, 2026 7:45 AM Title updated View changes

Type	Values Removed	Values Added
Title	HTTP Request Smuggling via Malformed Trailer Header in Eclipse Grizzly

Jul 17, 2026 11:15 PM Title updated View changes

Type	Values Removed	Values Added
Title		HTTP Request Smuggling via Malformed Trailer Header in Eclipse Grizzly

Jul 14, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Eclipse Eclipse glassfish
Vendors & Products		Eclipse Eclipse glassfish

Jul 14, 2026 9:15 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling.
Weaknesses		CWE-444
References		https://gitlab.eclipse.org/security/cve-assignment/-/work_items/129
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}`