Vulnerability DatabaseCVE-2026-12606
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-12606
Published:July 14, 2026
Updated:August 06, 2026
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to "true".
Affected Packages
https://github.com/eclipse-ee4j/grizzly.git (GITHUB):
Affected version(s) >=5.0.0-RELEASE <5.0.2
Fix Suggestion:
Update to version 5.0.2
org.glassfish.grizzly:grizzly-http (JAVA):
Affected version(s) >=5.0.0 <5.0.2
Fix Suggestion:
Update to version 5.0.2
Related Resources (3)
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/129
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12606.json
https://nvd.nist.gov/vuln/detail/CVE-2026-12606
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-444
EPSS
Base Score:
0.19