Jmcc0Nn3Ll

**Name of the Vulnerable Software and Affected Versions** Eclipse Jetty versions 9.0.0 through 9.4.52 Eclipse Jetty versions 10.0.0 through 10.0.15 Eclipse Jetty versions 11.0.0 through 11.0.15 **Description** The issue is caused by an integer overflow in `MetaDataBuilder.checkSize`, allowing HTTP/2 HPACK header values to exceed their size limit. When the length is very large and huffman is true, the multiplication by 4 will overflow, and the length will become negative. This can lead to a very large buffer allocation later on when the user-entered size is multiplied by 2. Users of HTTP/2 can be impacted by a remote denial of service attack. **Recommendations** For Eclipse Jetty versions 9.0.0 through 9.4.52, upgrade to version 9.4.53 or later. For Eclipse Jetty versions 10.0.0 through 10.0.15, upgrade to version 10.0.16 or later. For Eclipse Jetty versions 11.0.0 through 11.0.15, upgrade to version 11.0.16 or later.

**Name of the Vulnerable Software and Affected Versions** Jetty versions prior to 9.4.51 Jetty versions prior to 10.0.14 Jetty versions prior to 11.0.14 Jetty versions prior to 12.0.0.beta0 **Description** Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY LANGUAGE="b; JSESSIONID=1337; c=d"` will be parsed as one cookie, with the name `DISPLAY LANGUAGE` and a value of `b; JSESSIONID=1337; c=d` instead of 3 separate cookies. This has security implications because if, say, `JSESSIONID` is an `HttpOnly` cookie, and the `DISPLAY LANGUAGE` cookie value is rendered on the page, an attacker can smuggle the `JSESSIONID` cookie into the `DISPLAY LANGUAGE` cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server or its logging system. **Recommendations** For versions prior to 9.4.51, upgrade to version 9.4.51 or later. For versions prior to 10.0.14, upgrade to version 10.0.14 or later. For versions prior to 11.0.14, upgrade to version 11.0.14 or later. For versions prior to 12.0.0.beta0, upgrade to version 12.0.0.beta0 or later. As a temporary workaround, consider restricting access to sensitive cookies until a patch is available. Avoid using the `DISPLAY LANGUAGE` cookie in a way that could allow an attacker to smuggle other cookies into it.