CVE-2026-0636 — LDAP Injection Vulnerability in LDAPStoreHelper.java

Affected: Legion of the Bouncy Castle Inc. BC-JAVA, Red Hat AMQ Broker 7.12.7, Red Hat AMQ Broker 7.13.5, Red Hat AMQ Broker 7.14.1, Red Hat Build of Apache Camel 4.14 for Quarkus 3.27, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat build of Quarkus 3.20.6.SP1, Red Hat build of Quarkus 3.27.3.SP1, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 and 35 more

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).

This vulnerability is associated with program files LDAPStoreHelper.

This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

GHSA-355h-qmc2-wpwf — Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Affected: Maven: org.eclipse.jetty:jetty-http

### Description (as reported)

Jetty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks.

### Background

This vulnerability is a new variant discovered while researching the "Funky Chunks" HTTP request smuggling techniques: - https://w4ke.info/2025/06/18/funky-chunks.html - https://w4ke.info/2025/10/29/funky-chunks-2.html

The original research tested various chunk extension parsing differentials but did not test quoted-string handling within extension values.

### Technical Details

**RFC 9112 Section 7.1.1** defines chunked transfer encoding: ``` chunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF chunk-ext = *( BWS ";" BWS chunk-ext-name [ BWS "=" BWS chunk-ext-val ] ) chunk-ext-val = token / quoted-string ```

**RFC 9110 Section 5.6.4** defines quoted-string: ``` quoted-string = DQUOTE *( qdtext / quoted-pair ) DQUOTE ```

A quoted-string continues until the closing DQUOTE, and `\r\n` sequences are not permitted within the quotes.

### Vulnerability

Jetty terminates chunk header parsing at `\r\n` inside quoted strings instead of treating this as an error.

**Expected (RFC compliant):** ``` Chunk: 1;a="value\r\nhere"\r\n ^^^^^^^^^^^^^^^^^^ extension value Body: [1 byte after the real \r\n] ```

**Actual (jetty):** ``` Chunk: 1;a="value ^^^^^ terminates here (WRONG) Body: here"... treated as body/next request ```

### Proof of Concept

```python #!/usr/bin/env python3 import…

Most recent entries from all

CVE-2026-0636 — LDAP Injection Vulnerability in LDAPStoreHelper.java

GHSA-355h-qmc2-wpwf — Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing