Niska

Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies

Ujawniono: 18.04.2023
Aktualizacja: 11.10.2026 13:20

Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism.

If Jetty sees a cookie VALUE that starts with " (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered.

So, a cookie header such as:

DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d" will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d

instead of 3 separate cookies.

Impact

This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server.

Patches

9.4.51.v20230217 - via PR #9352
10.0.15 - via PR #9339
11.0.15 - via PR #9339

Workarounds

No workarounds

References

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

Platforma	Paczka	Podatne wersje	Poprawka w wersji
Java / Kotlin (Maven)	org.eclipse.jetty:jetty-server	< 9.4.51.v20230217, >= 10.0.0, < 10.0.14, >= 11.0.0, < 11.0.14, >= 12.0.0alpha0, < 12.0.0.beta0	9.4.51.v20230217, 10.0.14, 11.0.14, 12.0.0.beta0

Odnośniki

Ocena CVSS 2.4/10

Wektor CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Słabość (CWE): CWE-200
Platforma: Java / Kotlin (Maven)
Paczka: org.eclipse.jetty:jetty-server
Ujawniono: 18.04.2023
Aktualizacja: 11.10.2026 13:20

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-p26g-97m4-6q7c - CC BY 4.0

Historia podatności: org.eclipse.jetty:jetty-server

Wszystkie opisane podatności tej paczki (Java / Kotlin (Maven)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (29) w archiwum

Wszystkich wpisów: 29
Pierwsza → ostatnia: 10.2018 07.2026
Bez poprawki: 0
Wykorzystywana w atakach: 0

Rozkład istotności

Krytyczna 4
Wysoka 10
Średnia 13
Niska 2

Ujawnienia w latach

2018: 8
2019: 5
2020: 2
2021: 3
2022: 3
2023: 2
2024: 1
2025: 1
2026: 4

22.07.2026

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

Wysoka · 7.5 CVE-2024-7708 >= 10.0.7, < 10.0.23, >= 11.0.7, < 11.0.23 10.0.23, 11.0.23
05.03.2026

The Eclipse Jetty Server Artifact has a Gzip request memory leak

Wysoka · 7.5 CVE-2026-1605 >= 12.1.0, < 12.1.6, >= 12.0.0, < 12.0.32 12.1.6, 12.0.32
08.05.2025

**UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request

Wysoka · 7.2 CVE-2024-13009 >= 9.4.0, < 9.4.57.v20241219 9.4.57.v20241219
18.04.2023

Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies ten wpis

Niska · 2.4 CVE-2023-26049 < 9.4.51.v20230217, >= 10.0.0, < 10.0.14, >= 11.0.0, < 11.0.14, >= 12.0.0alpha0, < 12.0.0.beta0 9.4.51.v20230217, 10.0.14, 11.0.14, 12.0.0.beta0
07.07.2022

Jetty SslConnection does not release pooled ByteBuffers in case of errors

Wysoka · 7.5 CVE-2022-2191 >= 10.0.0, < 10.0.10, >= 11.0.0, < 11.0.10 10.0.10, 11.0.10
06.04.2021

Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

Wysoka · 7.5 CVE-2021-28165 >= 7.2.2, < 9.4.39, >= 10.0.0, < 10.0.2, >= 11.0.0, < 11.0.2 9.4.39, 10.0.2, 11.0.2
05.08.2020

Operation on a Resource after Expiration or Release in Jetty Server

Krytyczna · 9.4 CVE-2019-17638 >= 9.4.27, < 9.4.30.v20200611 9.4.30.v20200611
28.03.2019

Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server

Wysoka · 7.5 CVE-2018-12545 >= 9.4.0, < 9.4.12.v20180830, >= 9.3.0, < 9.3.25.v20180904 9.4.12.v20180830, 9.3.25.v20180904
09.11.2018

Jetty vulnerable to exposure of sensitive information to unauthenticated remote users

Wysoka · 7.5 CVE-2015-2080 < 9.2.9.v20150224 9.2.9.v20150224
19.10.2018

Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)

Krytyczna · 9.8 CVE-2017-7658 < 9.2.25.v20180606, >= 9.3.0, < 9.3.24.v20180605, >= 9.4.0, < 9.4.11.v20180605 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605
19.10.2018

Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)

Wysoka · 7.5 CVE-2017-7656 < 9.3.24.v20180605, >= 9.4.0, < 9.4.11.v20180605 9.3.24.v20180605, 9.4.11.v20180605
19.10.2018

Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request

Krytyczna · 9.8 CVE-2016-4800 >= 9.3.0, < 9.3.9 9.3.9
19.10.2018

Jetty vulnerable to exposure of sensitive information due to observable discrepancy

Wysoka · 7.5 CVE-2017-9735 >= 9.4.0, < 9.4.6.v20170531, >= 9.3.0, < 9.3.20.v20170531, < 9.2.22.v20170606 9.4.6.v20170531, 9.3.20.v20170531, 9.2.22.v20170606
19.10.2018

Critical severity vulnerability that affects org.eclipse.jetty:jetty-server

Krytyczna · 9.8 CVE-2017-7657 < 9.2.25.v20180606, >= 9.3.0, < 9.3.24.v20180605 9.2.25.v20180606, 9.3.24.v20180605
16.10.2018

Access and integrity issue within Eclipse Jetty

Wysoka · 8.8 CVE-2018-12538 >= 9.4.0, < 9.4.11.v20180605 9.4.11.v20180605

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację