Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to "true".
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-14 | 1 | Disclosure1 |
| 2026-07-15 | 1 | General1 |
| 2026-07-28 | 1 | PoC1 |
my write-up on CVE-2026-12606, request smuggling in Grizzly, leading to account takeover on Open-Xchange amongst other targets http://x.com/i/article/2081902914759794688
Post summary
The tweet shares a write‑up on CVE‑2026‑12606 detailing a request‑smuggling flaw in Grizzly that permits account takeover on Open‑Xchange, effectively offering a proof‑of‑concept for the vulnerability.
CVE-2026-12606 Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request… https://www.cve.org/CVERecord?id=CVE-2026-12606
Post summary
The note announces CVE‑2026‑12606 affecting Eclipse Grizzly versions prior to 5.0.2, describing an improper parsing of trailer headers that could lead to HTTP request manipulation; no PoC, exploitation, patch, or debunking details are included.
🟠 Eclipse Grizzly, HTTP Request Smuggling, #CVE-2026-12606 (Medium) -DC-Jul2026-976 https://dailycve.com/eclipse-grizzly-http-request-smuggling-cve-2026-12606-medium-dc-jul2026-976/
Post summary
The text announces a Medium severity CVE-2026-12606 related to HTTP Request Smuggling in Eclipse Grizzly, but provides no additional details about proof of concept, exploitation, or mitigation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | eclipse | grizzly | - | - | - |