CVE-2023-36479 Jetty vulnerable to errant command quoting in CGI Servlet

What is CVE-2023-36479?

CVE-2023-36479 is a low-severity command injection vulnerability in Debian Debian Linux, published on 15 Sep 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.

Weakness: CWE-149

Which versions are affected by CVE-2023-36479?

12 open source packages ship an affected version, including org.eclipse.jetty:jetty-servlets, org.eclipse.jetty.ee10:jetty-ee10-servlets and org.eclipse.jetty.ee8:jetty-ee8-servlets. It affects 2 products.

Products include Debian Debian Linux, Eclipse Jetty.

How do I fix CVE-2023-36479?

Upgrade org.eclipse.jetty:jetty-servlets to a fixed version for your release line: 10.0.16, 11.0.16 or 9.4.52.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-36479 being exploited?

There is no known exploitation of CVE-2023-36479 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-GQ19104, CLEANSTART-2026-HP29225, CLSA-2026-1785926105, DEBIAN-CVE-2023-36479, GHSA-3gh6-v5v9-6v9j, UBUNTU-CVE-2023-36479.