jetty-line-check

Which of these six 2026 CVEs has your Jetty (or the Jetty pulled in by Spring Boot) been hit by — and does the version the official guidance tells you to upgrade to actually exist on Maven Central?

The headline is CVE-2026-2332 (GHSA-355h-qmc2-wpwf, high / CVSS v3 7.4): chunked request smuggling in jetty-http. On 2026-09-17 the official project released the same-family CVE-2026-19203 (LF EXT.TERM smuggling, high / CVSS v4 8.3): its 9.4 line covers up to 9.4.63, and the official guidance tells you to upgrade to 9.4.64 — which is likewise 404 on Central. The hardest fact of all: the publicly available fixed versions for the three EOL lines 9.4 / 10 / 11 simply do not exist — the official security page says see details for availability for each of them (= commercial support), and those version numbers all test as 404 on Maven Central.

java -jar jetty-line-check.jar /path/to/jetty         # unpacked Jetty deployment (scans lib/*.jar)
java -jar jetty-line-check.jar app.war                # war
java -jar jetty-line-check.jar app.jar                # Spring Boot fat jar
java -jar jetty-line-check.jar --table                # only show the six-CVE × module × version-line verdict table
java -jar jetty-line-check.jar --utf8 ...             # add this when the Windows console garbles Chinese text

Criterion: coordinates + version line → verdict table + real-jar probing on Central

The sister project tomcat-line-check uses the criterion "does the jar contain a particular fix class", because that Tomcat fix added a new class.

That doesn't work for these Jetty issues. The headline CVE-2026-2332's fix changes the method body of HttpParser and adds no new class (confirmed before building with gh api compare + javap). So the only viable criterion is:

Which CVEs your full coordinates + version line hit; and whether the fix version the official guidance names actually exists on Maven Central.

The verdict table is generated by tools/gen_table.py from the vulnerabilities[] of the six GitHub advisories + real-jar HEAD probes against Maven Central, and it refuses to emit the table unless seven groups of assertions pass (positive control / core claim / old-line final versions / sentinel / headline structure / split modules / ratings).

The three states of fix-version availability (the hard core of this tool)

State	Meaning
PUBLIC	The advisory names a fix version, and it really is on Maven Central — publicly upgradeable
404	The advisory names a fix version, but it is 404 on Central — the official security page says see details for availability (commercial support)
none	The advisory gives no fix version for this line (first_patched_version is empty) — the only way to fix this line is a cross-major-version upgrade

That whole expanse of 404 and none across the old lines (9.4 / 10.0 / 11.0) is where this tool's value lies. Run --table to see the full picture.

The six covered (all reviewed org.eclipse.jetty advisories, 2026)

CVE	Module	Rating	One-liner
CVE-2026-2332	jetty-http	high / v3 7.4	⭐ Headline: \r\n inside a chunked quoted-string is treated as the end of a chunk header → request smuggling (CWE-444)
CVE-2026-19203	jetty-http	high / v4 8.3	⭐ Same-family sequel to 2332 (09-17): \n (LF) in a chunk extension is treated as the end of a chunk header → smuggling (LF EXT.TERM); the 9.4 line covers up to 9.4.63
CVE-2026-5795	jaspi (12.x split into ee8/9/10/11-jaspi)	high / v3 7.4	JASPI's ThreadLocal is not cleared → privilege escalation
CVE-2026-6790	jetty-server	medium / v3 5.3	HTTP/2·3 Host / :authority confusion
CVE-2026-10050	jetty-security (12.x adds ee8/9-security)	high / v4 8.7	Digest authentication ISO-8859-1 handling
CVE-2025-11143	jetty-http	low / v3 3.7	URI parsing discrepancy

🔴 The affected surface of the two smuggling issues (2332 and 19203) holds up (both land on the default parsing main path of ServerConnector / HttpParser, and require no particular feature to be enabled). The other four are just a row in the verdict table:

• ⚠️ The 12.1 line of 19203 is the exception: 12.1.x in its default RFC9110-compliant mode is not affected; only an explicit RFC7230 / RFC2616 configuration hits it — this tool flags that precondition for 12.1.x (both in --table and in scan output), so don't false-positive on default deployments. The 9.4 / 10 / 11 / 12.0 lines are hit by default.
• CVE-2026-10050 (Digest) has a very small affected surface — you only reach it if Digest authentication is explicitly enabled, so don't treat it as a headline selling point.
• CVE-2026-6790 is medium and CVE-2025-11143 is low — do not lump them together as "high severity".

The boundaries of what we say (this tool doesn't cross them, and neither should you)

• "Hits the affected range" is an artifact fact; "you will be attacked" is a different matter. This tool's wording is always the former.
• Both headline issues (CVE-2026-2332 / CVE-2026-19203) are request smuggling: there must also be a front-end proxy / LB in front, and the two ends must interpret the same request inconsistently, for harm to even be on the table. You can't tell an attack story about a bare Jetty — these two are v3 7.4 / v4 8.3 respectively, not "whoever installs it is done for".
• "The global vulnerability database has no range for 19203" is an empirical observation (as of the day of writing): its global advisory's vulnerabilities is empty, so Dependabot can report "this hole exists" but cannot say "upgrade to what"; the range exists only in the repository-level advisory. Once the global database catches up, this sentence must change.
• "404 on Central" is an empirical fact; "the official project is hiding the patch to sell it" is something you should not say on the official project's behalf. What the official page itself says is see details for availability, and that's where it ends.
• Nor is it "Jetty has stopped releasing" — the 12.0 / 12.1 lines are still being updated, and the public fix versions for those two lines are both on Central.

Primary sources

• Headline advisory: https://github.com/advisories/GHSA-355h-qmc2-wpwf (2332, includes a runnable PoC and a link to the Funky Chunks research)
• 19203 (same-family sequel to 2332, LF EXT.TERM): repository-level https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h (the range and PoC are here; the global GHSA-p2j5-5566-vpv9 has empty vulnerabilities)
• The other four: GHSA-r7p8-xq5m-436c · GHSA-7p3p-8qv8-m2vh · GHSA-2fvj-hgj9-j2gr · GHSA-wjpw-4j6x-6rwh
• Official security page (source of see details for availability): https://jetty.org/security.html
• Version-line EOL: https://jetty.org/download.html

Regenerate / re-verify before publishing

python tools/gen_table.py --dry              # run assertions only, don't write files
python tools/gen_table.py                    # only write CveTable.java if all assertions pass
python tools/recheck_before_publish.py       # re-run on the day of publishing; if a claim no longer holds, change the copy, not the criterion

Build

mvn package      # requires JDK 17; zero runtime dependencies (JUnit is test-only)

Exit codes

Code	Meaning
0	Scan finished, and every file was actually read
2	Usage error (no path given)
4	Some file could not be read — not a zip, truncated content, or read failure