CVE-2023-26049— Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty
Quick assessment
Affected
eclipse jetty.project
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。 Eclipse Jetty 存在信息泄露漏洞，该漏洞源于非标准 cookie 解析可能允许攻击者在其他 cookie 中走私 cookie，或者通过篡改 cookie 解析机制来执行意外行为。受影响的产品和版本：Jetty-server 9.4.50及之前版本，10.013及之前版本，11.0.13及之前版本，12.0.0.alpha3及之前版本。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-26049
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty
Source: CVE Program / CVE List V5
Vulnerability Description
Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d"` will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate cookies. This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server or its logging system. This issue has been addressed in versions 9.4.51, 10.0.14, 11.0.14, and 12.0.0.beta0 and users are advised to upgrade. There are no known workarounds for this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Eclipse Jetty 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。 Eclipse Jetty 存在信息泄露漏洞，该漏洞源于非标准 cookie 解析可能允许攻击者在其他 cookie 中走私 cookie，或者通过篡改 cookie 解析机制来执行意外行为。受影响的产品和版本：Jetty-server 9.4.50及之前版本，10.013及之前版本，11.0.13及之前版本，12.0.0.alpha3及之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| eclipse | jetty.project | < 9.4.51 | - |
|
II. Public POCs for CVE-2023-26049
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/hshivhare67/Jetty_v9.4.31_CVE-2023-26049 | POC Details |
| 2 | None | https://github.com/nidhihcl75/jetty-9.4.31.v20200723_G3_CVE-2023-26049 | POC Details |
| 3 | None | https://github.com/uthrasri/jetty-9.4.31.v20200723_CVE-2023-26049 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-26049
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-26049 (2)
-
https://github.com/eclipse/jetty.project/pull/9339 x_refsource_MISC
-
https://github.com/eclipse/jetty.project/pull/9352 x_refsource_MISC
Vendor Advisories for CVE-2023-26049 (3)
-
https://github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7c x_refsource_CONFIRM
Mailing List Discussions for CVE-2023-26049 (1)
Other References for CVE-2023-26049 (2)
-
https://www.rfc-editor.org/rfc/rfc6265 x_refsource_MISC
-
https://www.rfc-editor.org/rfc/rfc2965 x_refsource_MISC
IV. Related Vulnerabilities
Same product: jetty.project
-
CVE-2024-22201
Jetty connection leaking on idle timeout when TCP congested -
CVE-2023-36478
HTTP/2 HPACK integer overflow and buffer allocation -
CVE-2023-41900
Jetty's OpenId Revoked authentication allows one request -
CVE-2023-40167
Jetty accepts "+" prefixed value in Content-Length -
CVE-2023-36479
Jetty vulnerable to errant command quoting in CGI Servlet
Same vendor: eclipse
-
CVE-2023-54344
Eclipse Equinox OSGi 3.7.2 Remote Code Execution via Console -
CVE-2023-54342
Eclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution -
CVE-2023-5632
Unconditionally adding an event to the epoll causes excessiv -
CVE-2023-36478
HTTP/2 HPACK integer overflow and buffer allocation -
CVE-2023-3592
Eclipse Mosquitto 安全漏洞
Same weakness: CWE-200
-
CVE-2026-92548
WP Popular Posts <= 7.4.2 - Unauthenticated Information Disc -
CVE-2026-102121
Kiteworks Secure Data Forms Exposure of Sensitive Informatio -
CVE-2026-47514
NVIDIA驱动内核栈信息泄露漏洞 -
CVE-2026-102845
gedelumbung HospitalManagement HTTP Response index.php error -
CVE-2026-90441
Fireware OS Missing Authorization in wgagent Management API
V. Comments for CVE-2023-26049
No comments yet