-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.eclipse.jetty:jetty-server | maven | >= 10.0.0, < 10.0.14 | 10.0.14 |
| org.eclipse.jetty:jetty-server | maven | >= 11.0.0, < 11.0.14 | 11.0.14 |
| org.eclipse.jetty:jetty-server | maven | >= 12.0.0alpha0, < 12.0.0.beta0 | 12.0.0.beta0 |
| org.eclipse.jetty:jetty-server | maven | < 9.4.51.v20230217 | 9.4.51.v20230217 |
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2023-26049 stems from nonstandard cookie parsing in Jetty. The patches (PR #9339 and #9352) specifically modified the CookieCutter class to address improper handling of quoted values. The parseFields() method in CookieCutter was responsible for splitting cookie headers and failed to terminate quoted values at semicolons, allowing attackers to smuggle cookies. The commit diffs show changes to cookie parsing logic, confirming this function's role in the vulnerability.
JavaJavaOngoing coverage of React2Shell