Description
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header-s line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to -true-.
CVSS 5.3EPSS 0.188%Risque 0.54
Voir la source- Publication
- 2026-07-14 09:16:39
- Versions concernées
- <5.0.2
- Type
- Bibliothèque
- Dernière modification
- 2026-07-27 13:16:51
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N