Popis
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header-s line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to -true-.
CVSS 5.3EPSS 0.188%Riziko 0.54
Zobraziť zdroj- Zverejnené
- 2026-07-14 09:16:39
- Dotknuté verzie
- <5.0.2
- Typ
- Knižnica
- Posledná úprava
- 2026-07-27 13:16:51
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N