Descrição
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header-s line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to -true-.
CVSS 5.3EPSS 0.188%Risco 0.54
Ver fonte- Publicação
- 2026-07-14 09:16:39
- Versões afetadas
- <5.0.2
- Tipo
- Biblioteca
- Última alteração
- 2026-07-27 13:16:51
- Vetor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N