Skip to content
Fencer Vulns
low 2.4

CVE-2023-26049 json

Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty

published 2023-04-18 3 y ago modified 2026-09-10 1 mo ago also EUVD-2023-1360 , GHSA-p26g-97m4-6q7c

cvss
2.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits
0
none known

Summary

Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d"` will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate cookies. This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server or its logging system. This issue has been addressed in versions 9.4.51, 10.0.14, 11.0.14, and 12.0.0.beta0 and users are advised to upgrade. There are no known workarounds for this issue.

Patch / fix

  • maven org.eclipse.jetty:jetty-server 9.4.51.v20230217, 10.0.14, 11.0.14, 12.0.0.beta0
  • eclipse jetty 9.4.51, 10.0.14, 11.0.14, 12.0.0.beta0
  • org.eclipse.jetty jetty-server 9.4.51, 10.0.14, 11.0.14, 12.0.0.beta0
  • jetty9 Debian 12 9.4.50-4+deb12u1
  • jetty9 Debian 14, Debian 13 9.4.52-1

debian advisories DEBIAN-CVE-2023-26049

  • eap7-avro jboss enterprise application platform 7.4 1.11.3-1.redhat_00001.1.el7eap
  • eap7-guava jboss enterprise application platform 7.4 32.1.1-2.jre_redhat_00001.1.el7eap
  • eap7-jandex jboss enterprise application platform 7.4 2.4.4-1.Final_redhat_00001.1.el7eap
  • eap7-yasson jboss enterprise application platform 7.4 1.0.11-4.redhat_00002.1.el7eap
  • eap7-jgroups jboss enterprise application platform 7.4 4.2.23-1.Final_redhat_00001.1.el7eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.14-5.GA_redhat_00002.1.el7eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.28-1.SP1_redhat_00001.1.el7eap
  • eap7-weld-ejb jboss enterprise application platform 7.4 3.1.10-2.Final_redhat_00001.1.el7eap

red hat advisories RHSA-2023:7637RHSA-2023:7638RHSA-2023:7639RHSA-2024:0778RHSA-2024:0800RHSA-2024:0799

  • jetty-minimal SLE Real Time 15 SP3, SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4 +2 more 9.4.51-150200.3.19.2

suse advisories SUSE-SU-2023:2539-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-26049 updated cvss 5.3

jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies

  • Red Hat Migration Toolkit for Applications 6 jetty-server Red Hat Migration Toolkit for Runtimes jetty-server Red Hat OpenShift Serverless jetty-server
    affected: no fix planned “Will not fix”
  • Red Hat build of Apache Camel for Spring Boot 3 jetty-server
    affected: no fix available
  • Red Hat Decision Manager 7 jetty-server
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 log4j, log4j-jcl, log4j-web, log4j-slf4j
    affected: no fix available
  • Red Hat Enterprise Linux 9 log4j, log4j-jcl, log4j-slf4j
    affected: no fix planned “Will not fix”
  • Red Hat Fuse 7 jetty-server
    affected: no fix planned “Out of support scope”
  • Red Hat Integration Camel K 1 jetty-server Red Hat Integration Camel Quarkus 2 jetty-server
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Data Grid 7 jetty-server Red Hat JBoss Enterprise Application Platform 6 jetty-server Red Hat JBoss Fuse 6 jetty-server Red Hat JBoss Fuse Service Works 6 jetty-server Red Hat OpenShift Container Platform 3.11 jenkins Red Hat Process Automation 7 jetty-server
    affected: no fix planned “Out of support scope”
show 15 more
  • Red Hat streams for Apache Kafka jetty-server
    affected: no fix available
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-41
    fixed: vendor fix RHSA-2024:0801
  • Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins 2.426.3.1706515686-3.el8
    fixed: vendor fix RHSA-2024:0778
  • Red Hat AMQ Streams 2.5.0
    fixed: vendor fix RHSA-2023:5165
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.14-5.GA_redhat_00002.1.el7eap, eap7-undertow 2.2.28-1.SP1_redhat_00001.1.el7eap, eap7-wildfly-modules 7.4.14-5.GA_redhat_00002.1.el7eap, eap7-wildfly-javadocs 7.4.14-5.GA_redhat_00002.1.el7eap, eap7-wildfly-java-jdk8 7.4.14-5.GA_redhat_00002.1.el7eap, eap7-wildfly-java-jdk11 7.4.14-5.GA_redhat_00002.1.el7eap, +1 more
    fixed: vendor fix RHSA-2023:7637
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.14-5.GA_redhat_00002.1.el8eap, eap7-undertow 2.2.28-1.SP1_redhat_00001.1.el8eap, eap7-wildfly-modules 7.4.14-5.GA_redhat_00002.1.el8eap, eap7-wildfly-javadocs 7.4.14-5.GA_redhat_00002.1.el8eap, eap7-wildfly-java-jdk8 7.4.14-5.GA_redhat_00002.1.el8eap, eap7-wildfly-java-jdk11 7.4.14-5.GA_redhat_00002.1.el8eap, +2 more
    fixed: vendor fix RHSA-2023:7638
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-wildfly 7.4.14-5.GA_redhat_00002.1.el9eap, eap7-undertow 2.2.28-1.SP1_redhat_00001.1.el9eap, eap7-wildfly-modules 7.4.14-5.GA_redhat_00002.1.el9eap, eap7-wildfly-javadocs 7.4.14-5.GA_redhat_00002.1.el9eap, eap7-wildfly-java-jdk8 7.4.14-5.GA_redhat_00002.1.el9eap, eap7-wildfly-java-jdk11 7.4.14-5.GA_redhat_00002.1.el9eap, +2 more
    fixed: vendor fix RHSA-2023:7639
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
    fixed: vendor fix RHSA-2024:3385
  • Red Hat Satellite 6.14 for RHEL 8 puppetserver 7.14.0-1.el8sat
    fixed: vendor fix RHSA-2024:0797
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2024:0804
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.12-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.12-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2024:0798
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.12-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.12-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2024:0799
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.12-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.12-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2024:0800
  • Red Hat RHINT Camel-Springboot 4.0.0
    fixed: vendor fix RHSA-2023:5441
  • Red Hat A-MQ Clients 2 jetty-server Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins 4.12.1706515741-1.el8 Red Hat AMQ Broker 7 jetty-server Red Hat build of Apicurio Registry 2 jetty-server Red Hat build of Debezium 2 jetty-server Red Hat Data Grid 8 jetty-server
    +4 more products
    Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-avro 1.11.3-1.redhat_00001.1.el7eap, eap7-yasson 1.0.11-4.redhat_00002.1.el7eap, eap7-guava 32.1.1-2.jre_redhat_00001.1.el7eap, eap7-apache-sshd 2.9.3-1.redhat_00001.1.el7eap, eap7-jandex 2.4.4-1.Final_redhat_00001.1.el7eap, eap7-jgroups 4.2.23-1.Final_redhat_00001.1.el7eap, +48 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-avro 1.11.3-1.redhat_00001.1.el8eap, eap7-yasson 1.0.11-4.redhat_00002.1.el8eap, eap7-guava 32.1.1-2.jre_redhat_00001.1.el8eap, eap7-apache-sshd 2.9.3-1.redhat_00001.1.el8eap, eap7-jandex 2.4.4-1.Final_redhat_00001.1.el8eap, eap7-jgroups 4.2.23-1.Final_redhat_00001.1.el8eap, +48 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-avro 1.11.3-1.redhat_00001.1.el9eap, eap7-yasson 1.0.11-4.redhat_00002.1.el9eap, eap7-guava 32.1.1-2.jre_redhat_00001.1.el9eap, eap7-apache-sshd 2.9.3-1.redhat_00001.1.el9eap, eap7-jandex 2.4.4-1.Final_redhat_00001.1.el9eap, eap7-jgroups 4.2.23-1.Final_redhat_00001.1.el9eap, +46 more Red Hat JBoss Enterprise Application Platform 7 jetty-server
    not affected: vulnerable code not present

4 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.30% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
GitHub 3.1 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.eclipse.jetty:jetty-server
<9.4.51.v20230217
>=10.0.0, <10.0.14
>=11.0.0, <11.0.14
>=12.0.0alpha0, <12.0.0.beta0
9.4.51.v20230217
10.0.14
11.0.14
12.0.0.beta0

Affected products

  • eclipse jetty.project

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: More precise artifact identification.