Descripción
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header-s line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to -true-.
CVSS 5.3EPSS 0.188%Riesgo 0.54
Ver fuente- Publicación
- 2026-07-14 09:16:39
- Versiones afectadas
- <5.0.2
- Tipo
- Librería
- Última modificación
- 2026-07-27 13:16:51
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N