CVE-2026-77711

When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may...

8.2 HighFix available

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).

The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the server, that now has access to the proxy credentials.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.44%Up 0.1 points since Oct 15, 2026

What each source reports

CVE List Score used 8.2

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).

Record: CVE-2026-77711
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-200
Updated: 2026-11-02

EUVDEUVD-2026-101947 8.2

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).

Record: EUVD-2026-101947
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-vv2w-r86m-5w27 8.2

When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may...

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).

Record: GHSA-vv2w-r86m-5w27
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-200
Updated: 2026-11-02

NVD 8.2

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).

Record: CVE-2026-77711
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-200
Updated: 2026-11-02

OSV 8.2

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).

Record: CVE-2026-77711
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-200
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-77711 8.2

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the server, that now has access to the proxy credentials.

Record: DEBIAN-CVE-2026-77711
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-04

Show 4 moreShow less

OSVUBUNTU-CVE-2026-77711 8.2

Record: UBUNTU-CVE-2026-77711
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVCLSA-2026-1790290763 No score

TuxCare security update for 123 packages (8 CVEs)

TuxCare rebuilt 123 packages to address 8 CVEs. Fixed in 10.0.33.tuxcare0001.

Record: CLSA-2026-1790290763
Updated: 2026-11-02

OSVCLSA-2026-1790305167 No score

TuxCare security update for 123 packages (8 CVEs)

TuxCare rebuilt 123 packages to address 8 CVEs. Fixed in 11.0.33.tuxcare0001.

Record: CLSA-2026-1790305167
Updated: 2026-11-02

OSVCLSA-2026-1790774766 No score

TuxCare security update for 86 packages (8 CVEs)

TuxCare rebuilt 86 packages to address 8 CVEs. Fixed in 9.4.65.tuxcare0001.

Record: CLSA-2026-1790774766
Updated: 2026-11-02

Affected products

eclipse foundation jetty

Affected packages

Affected packages
Package	Affected	Fixed
`org.eclipse.jetty.demos:demo-async-rest-jar` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-container-initializer` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jaas-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jetty-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jndi-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jsp-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-mock-resources` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001

Show 197 moreShow less

Affected packages
Package	Affected	Fixed
`org.eclipse.jetty.demos:demo-proxy-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-simple-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-spec` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-spec-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-web-fragment` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demos-jetty-embedded` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demos-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.documentation:code-examples` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.documentation:documentation-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.documentation:jetty` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.gcloud:gcloud-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.gcloud:jetty-gcloud-session-manager` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-hpack` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-http-client-transport` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-http-client-transport` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-qpack` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.memcached:jetty-memcached-sessions` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.memcached:memcached-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-httpservice` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-alpn` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-jsp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-warurl` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-project` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:test-jetty-osgi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-foreign-incubator` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-jna` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-javax-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-javax-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-javax-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-api` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-servlet` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:apache-jsp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:apache-jstl` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-embedded` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-embedded-query` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-remote` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-remote-query` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-java-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-java-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-annotations` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-ant` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-bom` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-cdi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-deploy` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-hazelcast` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-home` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-http` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-http-spi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-io` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jaas` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jaspi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jmx` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jndi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jspc-maven-plugin` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-keystore` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-maven-plugin` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-nosql` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-openid` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-p2` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-plus` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-project` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-proxy` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-quickstart` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-rewrite` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-runner` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-security` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-servlet` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-servlets` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-slf4j-impl` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-start` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixdomain-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-util` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-util-ajax` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-xml` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-jar` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-container-initializer` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jaas-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jetty-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jndi-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jsp-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-mock-resources` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-proxy-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-simple-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-spec` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-spec-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-web-fragment` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demos-jetty-embedded` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demos-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.documentation:code-examples` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.documentation:documentation-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.documentation:jetty` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.gcloud:gcloud-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.gcloud:jetty-gcloud-session-manager` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-hpack` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-http-client-transport` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-http-client-transport` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-qpack` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.memcached:jetty-memcached-sessions` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.memcached:memcached-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-httpservice` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-alpn` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-jsp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-warurl` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-project` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:test-jetty-osgi` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-foreign-incubator` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-jna` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jakarta-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jakarta-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jakarta-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-api` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-servlet` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:apache-jsp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:glassfish-jstl` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-embedded` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-embedded-query` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-remote` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-remote-query` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`jetty12` Debian:13	All versions, plus listed versions 12.0.17-312.0.17-3.112.0.17-3.1~deb13u112.0.32-112.0.32-2 Show 4 moreShow less 12.0.33-112.0.39-112.0.40-112.0.40-2	None known
`jetty12` Debian:14	before 12.0.39-1, plus listed versions 12.0.17-312.0.17-3.112.0.17-3.1~deb13u112.0.32-112.0.32-212.0.33-1	12.0.39-1
`jetty9` Debian:12	All versions, plus listed versions 9.4.50-49.4.50-4+deb12u19.4.50-4+deb12u29.4.50-4+deb12u39.4.51-1 Show 13 moreShow less 9.4.51-29.4.52-19.4.53-19.4.54-19.4.55-19.4.56-19.4.57-0+deb12u19.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2	None known
`jetty9` Debian:13	All versions, plus listed versions 9.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2	None known
`jetty9` Debian:14	All versions, plus listed versions 9.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2	None known
`jetty` Ubuntu:14.04:LTS	All versions, plus listed versions 6.1.26-1ubuntu16.1.26-1ubuntu1.16.1.26-1ubuntu1.2	None known
`jetty` Ubuntu:16.04:LTS	All versions, plus listed versions 6.1.26-56.1.26-5ubuntu0.1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 4, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-77711 is a high vulnerability (CVSS 8.2) in Eclipse Foundation Jetty, published September 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in jetty12 12.0.39-1.

References

This page doesn't list everything

Also not on the record: 132 package claims. ID and package lookups still check them.