Vulnerability in Eclipse Grizzly
CVE-2026-12606
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to "true".
Vulnerability class: HTTP Request Smuggling
EPSS: 0.003 (21.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Eclipse Grizzly
- Eclipse Foundation Glassfish — versions 4.0.0, 5.0.0
Weakness classification (CWE)
References
- emo@eclipse.org (Issue Tracking)
Frequently asked questions
- What is CVE-2026-12606?
- CVE-2026-12606 is a medium-severity vulnerability in Eclipse Grizzly, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 5.3/10. Published 2026-07-14.
- How severe is CVE-2026-12606?
- Medium severity. CVSS v3 base score is 5.3 out of 10.