CVE-2026-12606mediumCWE-444

CVE-2026-12606: medium-severity vulnerability in Eclipse GlassFish

Published · Updated

Follow this CVE+ Monitor Eclipse Glassfish

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.3%
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110 and org.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110 system properties to "true".
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
Eclipse Foundation · Eclipse GlassFish
Related CVEs — Eclipse GlassFish

In the same product, most dangerous first.

CVE-2026-24457CRITICALCVE-2026-24457EPSS 0.7%CVE-2026-12605CRITICALCVE-2026-12605EPSS 0.4%