Description
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to "true".
Published: 2026-07-14
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Eclipse Grizzly versions before 5.0.2 incorrectly parse the trailer section of malformed trailer headers, allowing an attacker to craft malicious HTTP requests that can be smuggled between legitimate requests. This flaw, identified as CWE-444, enables HTTP request smuggling against exposed GlassFish servers.

Affected Systems

Eclipse GlassFish deployments that use Eclipse Grizzly older than version 5.0.2 are affected. No specific sub‑versions beyond this threshold are listed.

Risk and Exploitability

The CVSS score is 6.3, indicating a medium impact, and the EPSS score is less than 1%, implying a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would involve sending crafted HTTP requests containing malformed trailer headers to GlassFish servers. The description does not specify any privileged access requirement.

Generated by OpenCVE AI on July 31, 2026 at 10:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Eclipse Grizzly to version 5.0.2 or later.
  • Apply any available Eclipse GlassFish security patches that incorporate the updated Grizzly library.
  • If upgrade is not feasible, enable strict trailer parsing by setting org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110=true and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110=true, or configure the server to reject HTTP requests containing trailer headers.

Generated by OpenCVE AI on July 31, 2026 at 10:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 31 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
Title HTTP Request Smuggling via Malformed Trailer Header in Eclipse Grizzly

Mon, 27 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to "true".

Fri, 24 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
Title HTTP Request Smuggling via Malformed Trailer Header in Eclipse Grizzly

Fri, 17 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
Title HTTP Request Smuggling via Malformed Trailer Header in Eclipse Grizzly

Tue, 14 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse glassfish
Vendors & Products Eclipse
Eclipse glassfish

Tue, 14 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
Description Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling.
Weaknesses CWE-444
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Eclipse Glassfish
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-07-27T11:37:48.096Z

Reserved: 2026-06-18T11:27:18.643Z

Link: CVE-2026-12606

cve-icon Vulnrichment

Updated: 2026-07-14T12:17:38.172Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T10:45:04Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')