Security Vulnerabilities Notes (Release 8.2)

Contains information about some of the security vulnerabilities addressed in HPE Data Fabric release 8.2.0.

Security Fixes in Jetty 9.4.x

HPE Data Fabric release 8.2 includes a modified version of Jetty 9.4 (9.4.64.v20261006-df) that backports fixes for the following security vulnerabilities.

  • CVE-2026-12611: HTTP/2 RST_STREAM/GOAWAY frame race condition causes thread starvation DoS.
  • CVE-2026-10050: HTTP Digest auth bypass via ISO-8859-1 charset conversion hash collision.
  • CVE-2026-6790: Host validation mismatch between Host and :authority in HTTP/2 and HTTP/3.
  • CVE-2026-2332: HTTP/1.1 request smuggling via unclosed quoted strings in chunk extensions.
  • CVE-2026-19203: HTTP/1.1 request smuggling via bare line feed (\n) chunk delimiter handling.
    NOTE
    CVE-2026-19203 fix disallows bare LFs in headers/trailers, chunk headers and chunk bodies. To allow it back (disable the fix), set the following JVM system property :
    -Dorg.eclipse.jetty.http.HttpParser.allowBareLF=true
  • CVE-2025-11143: Differential URI parsing disparity between Jetty and front-end reverse proxies.