CVE-2026-6790 Details
Description
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying * Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.
A vulnerability exists in Eclipse Jetty versions 9.4.0 through 9.4.60, 10.0.0 through 10.0.28, 11.0.0 through 11.0.28, and 12.0.0 through 12.1.8. The issue arises because Jetty does not strictly verify that the request authority (host and port) aligns with the Host header in HTTP/1, HTTP/2, and HTTP/3 requests. While earlier HTTP RFCs, such as RFC 2616, did not mandate this alignment, the latest RFCs (9110 and 9112) do. This oversight can lead to various vulnerabilities, including issues with URI construction for redirects, virtual host selection, reverse proxying, and misleading log entries. Given the requirements of the latest RFCs, Jetty should implement this enforcement.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| eclipse jetty | >= 9.4.0, < 9.4.61 >= 10.0.0, < 10.0.29 >= 11.0.0, < 11.0.29 >= 12.0.0, < 12.0.35 >= 12.1.0, < 12.1.9 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |