Read the docs
TI-2023-11283 Aliases CVE-2023-26049GHSA-p26g-97m4-6q7c

Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty

Priority LOW 27CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 13 fixed, 17 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d"` will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate cookies. This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server or its logging system. This issue has been addressed in versions 9.4.51, 10.0.14, 11.0.14, and 12.0.0.beta0 and users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

EPSS 0.013 70th percentileScored 2026-11-07
Fix Partial jetty.project (eclipse): 9.4.51, 10.0.14, 11.0.14 +1org.eclipse.jetty:jetty-server (Maven): 9.4.51.v20230217, 10.0.14, 11.0.14 +1Red Hat: 12 advisoriesRed Hat: 13 fixed, 17 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse Foundationjetty.projectbefore 9.4.51; 10.0.0 to before 10.0.14; 11.0.0 to before 11.0.14; 12.0.0.alpha0 to before 12.0.0.beta09.4.51, 10.0.14, 11.0.14, 12.0.0.beta0Patch availableCNA
—org.eclipse.jetty:jetty-server (Maven)before 9.4.51.v202302179.4.51.v20230217Patch availableGHSA-p26g-97m4-6q7c
—org.eclipse.jetty:jetty-server (Maven)10.0.0 to before 10.0.1410.0.14Patch availableGHSA-p26g-97m4-6q7c
—org.eclipse.jetty:jetty-server (Maven)11.0.0 to before 11.0.1411.0.14Patch availableGHSA-p26g-97m4-6q7c
—org.eclipse.jetty:jetty-server (Maven)12.0.0alpha0 to before 12.0.0.beta012.0.0.beta0Patch availableGHSA-p26g-97m4-6q7c
  • jetty.project VendorEclipse Foundation Affected before 9.4.51; 10.0.0 to before 10.0.14; 11.0.0 to before 11.0.14; 12.0.0.alpha0 to before 12.0.0.beta0 Fixed in 9.4.51, 10.0.14, 11.0.14, 12.0.0.beta0 Patch available CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected before 9.4.51.v20230217 Fixed in 9.4.51.v20230217 Patch available GHSA-p26g-97m4-6q7c
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 10.0.0 to before 10.0.14 Fixed in 10.0.14 Patch available GHSA-p26g-97m4-6q7c
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 11.0.0 to before 11.0.14 Fixed in 11.0.14 Patch available GHSA-p26g-97m4-6q7c
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 12.0.0alpha0 to before 12.0.0.beta0 Fixed in 12.0.0.beta0 Patch available GHSA-p26g-97m4-6q7c

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*before 9.4.51; 10.0.0 to before 10.0.14; 11.0.0 to before 11.0.14VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:12.0.0:alpha1:*:*:*:*:*:*12.0.0 alpha1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:12.0.0:alpha2:*:*:*:*:*:*12.0.0 alpha2VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:12.0.0:alpha3:*:*:*:*:*:*12.0.0 alpha3VulnerableEclipse Foundation
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*12.0VulnerableDebian
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*11.0VulnerableNetApp
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions before 9.4.51; 10.0.0 to before 10.0.14; 11.0.0 to before 11.0.14 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:12.0.0:alpha1:*:*:*:*:*:* Versions 12.0.0 alpha1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:12.0.0:alpha2:*:*:*:*:*:* Versions 12.0.0 alpha2 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:12.0.0:alpha3:*:*:*:*:*:* Versions 12.0.0 alpha3 Vulnerable ·Eclipse Foundation
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·NetApp
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · CNA jetty.project (eclipse) Fixed in 9.4.51, 10.0.14, 11.0.14, 12.0.0.beta0
  • Fix · GHSA-p26g-97m4-6q7c org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.51.v20230217 Advisory →
  • Fix · GHSA-p26g-97m4-6q7c org.eclipse.jetty:jetty-server (Maven) Fixed in 10.0.14 Advisory →
  • Fix · GHSA-p26g-97m4-6q7c org.eclipse.jetty:jetty-server (Maven) Fixed in 11.0.14 Advisory →
  • Fix · GHSA-p26g-97m4-6q7c org.eclipse.jetty:jetty-server (Maven) Fixed in 12.0.0.beta0 Advisory →

Red Hat 12 advisories

  • RHSA-2024:0804 Released 2024-02-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.7 security update
    • Red Hat Single Sign-On 7
  • RHSA-2024:0798 Released 2024-02-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.7 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.12-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.12-1.redhat_00001.1.el7sso
  • RHSA-2024:0800 Released 2024-02-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.7 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.12-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.12-1.redhat_00001.1.el9sso
Show 9 more Red Hat advisories
  • RHSA-2024:0799 Released 2024-02-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.7 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.12-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.12-1.redhat_00001.1.el8sso
  • RHSA-2024:0801 Released 2024-02-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.7 for OpenShift image enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2024:0797 Released 2024-02-13 · Red Hat rating Important
    Satellite 6.14.2 Async Security Update
    • Red Hat Satellite 6.14 for RHEL 8 candlepin-4.3.11-1.el8sat, candlepin-selinux-4.3.11-1.el8sat, mosquitto-2.0.17-1.el8sat +5
  • RHSA-2024:0778 Released 2024-02-12 · Red Hat rating Important
    Jenkins and Jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1706515741-1.el8, jenkins-2.426.3.1706515686-3.el8
  • RHSA-2023:7638 Released 2023-12-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 8 security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el8eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el8eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el8eap +47
  • RHSA-2023:7637 Released 2023-12-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 7 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el7eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el7eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el7eap +47
  • RHSA-2023:7639 Released 2023-12-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 9 security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el9eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el9eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el9eap +47
  • RHSA-2023:5441 Released 2023-10-04 · Red Hat rating Moderate
    Red Hat Integration Camel for Spring Boot 4.0.0 release and security update
    • RHINT Camel-Springboot 4.0.0
  • RHSA-2023:5165 Released 2023-09-14 · Red Hat rating Important
    Red Hat AMQ Streams 2.5.0 release and security update
    • Red Hat AMQ Streams 2.5.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 6AffectedNo fix planned: Will not fix
Migration Toolkit for RuntimesAffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix planned: Will not fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat Integration Camel Quarkus 2AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel for Spring Boot 3AffectedNo fix yet
streams for Apache KafkaAffectedNo fix yet
Middleware Containers for OpenShiftFixed RHSA-2024:0801
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2024:0778
RHINT Camel-Springboot 4.0.0Fixed RHSA-2023:5441
Red Hat AMQ Streams 2.5.0Fixed RHSA-2023:5165
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:7637
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:7638
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:7639
Red Hat JBoss Enterprise Application Platform Expansion PackFixed RHSA-2024:3385
Red Hat Satellite 6.14 for RHEL 8Fixed RHSA-2024:0797
Red Hat Single Sign-On 7Fixed RHSA-2024:0804
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2024:0798
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2024:0799
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2024:0800
Not affected: 14 products
  • A-MQ Clients 2
  • OpenShift Developer Tools and Services for OCP 4.12
  • Red Hat AMQ Broker 7
  • Red Hat Data Grid 8
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat OpenShift Application Runtimes
  • Red Hat OpenShift Container Platform 4
  • Red Hat Satellite 6.14 for RHEL 8
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Debezium 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-26049
  2. 2026-10-03 Alias added: GHSA-p26g-97m4-6q7c

References

Patch 3

Advisory 4

Other 5

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences