CVE-2023-26049

Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d"` will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate cookies. This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server or its logging system. This issue has been addressed in versions 9.4.51, 10.0.14, 11.0.14, and 12.0.0.beta0 and users are advised to upgrade. There are no known workarounds for this issue.

• CWE-200

• https://github.com/eclipse/jetty.project/pull/9339Patch
• https://github.com/eclipse/jetty.project/pull/9352Patch
• https://github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7cPatch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/09/msg00039.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20230526-0001/Third Party Advisory
• https://www.debian.org/security/2023/dsa-5507Third Party Advisory
• https://www.rfc-editor.org/rfc/rfc2965Technical Description
• https://www.rfc-editor.org/rfc/rfc6265Technical Description
• https://github.com/eclipse/jetty.project/pull/9339Patch
• https://github.com/eclipse/jetty.project/pull/9352Patch
• https://github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7cPatch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/09/msg00039.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20230526-0001/Third Party Advisory
• https://www.debian.org/security/2023/dsa-5507Third Party Advisory
• https://www.rfc-editor.org/rfc/rfc2965Technical Description
• https://www.rfc-editor.org/rfc/rfc6265Technical Description

Published

Apr 18, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26043GeoNode is an open source platform that facilitates the crea…6.5
• CVE-2023-26044react/http is an event-driven, streaming HTTP client and ser…5.3
• CVE-2023-26045NodeBB is Node.js based forum software. Starting in version …9.8
• CVE-2023-26046teler-waf is a Go HTTP middleware that provides teler IDS fu…6.1
• CVE-2023-26047teler-waf is a Go HTTP middleware that provides teler IDS fu…6.1
• CVE-2023-26048Jetty is a java based web server and servlet engine. In affe…5.3
• CVE-2023-2605The wpbrutalai WordPress plugin before 2.0.1 does not saniti…6.1
• CVE-2023-26051Saleor is a headless, GraphQL commerce platform delivering p…4.3
• CVE-2023-26052Saleor is a headless, GraphQL commerce platform delivering p…5.3
• CVE-2023-26053Gradle is a build tool with a focus on build automation and …9.8
• CVE-2023-26054BuildKit is a toolkit for converting source code to build ar…6.5
• CVE-2023-26055XWiki Commons are technical libraries common to several othe…9.9