{"id":"CVE-2026-6790","aliases":["CLSA-2026-1779065207","CLSA-2026-1779065208","CLSA-2026-1779065209","CLSA-2026-1785291679","CLSA-2026-1786356731","CLSA-2026-1786358468","CLSA-2026-1786441499","CLSA-2026-1786441655","CLSA-2026-1786467443","CLSA-2026-1786482291","CLSA-2026-1787658666","CLSA-2026-1792753531","CLSA-2026-1792756836","CLSA-2026-1793132217","CLSA-2026-1793136455","CLSA-2026-1793790043","CLSA-2026-1793796534","CLSA-2026-1793798237","CLSA-2026-1794235772","CLSA-2026-1794244898","CLSA-2026-1794251641","DEBIAN-CVE-2026-6790","EUVD-2026-43646","GHSA-7p3p-8qv8-m2vh","UBUNTU-CVE-2026-6790"],"status":"published","title":"Eclipse Jetty: HTTP Authority/Host mismatch","description":"In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n  *  \n        \n      URI constructions (for example, for redirects -- this is typical for login pages)\n\n  *  \n        \n      Virtual host selection\n\n  *  \n        \n      Reverse proxying\n\n  *  \n        \n      Misleading logs\n\n  *  \n        \n      Etc.\n\n\n\n\n\n\nGiven that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0031,"percentile":0.24066,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2026-07-14T08:51:30Z","modified":"2026-11-10T01:15:05Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["12.0.35","12.1.9"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["10.0.30.tuxcare0001","11.0.30.tuxcare0001","11.0.29.tuxcare0003","9.4.61.tuxcare0003","9.4.60.tuxcare0003","10.0.26-tuxcare.3","10.0.29.tuxcare0003","11.0.28.tuxcare0004","9.4.57.v20241219-tuxcare.7","9.4.59.tuxcare0004"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jetty12","fixed_in":["12.0.39-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0.v20161208"},{"last_affected":"9.4.58.v20250814"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"last_affected":"10.0.26"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"last_affected":"11.0.26"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.34"},{"fixed":"12.0.35"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"last_affected":"12.1.8"},{"fixed":"12.1.9"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.62"},{"fixed":"9.4.62.tuxcare0001"}]}],"versions":["9.4.62"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.62"},{"fixed":"9.4.62.tuxcare0001"}]}],"versions":["9.4.62"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.30"},{"fixed":"10.0.30.tuxcare0001"}]}],"versions":["10.0.30"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.30"},{"fixed":"11.0.30.tuxcare0001"}]}],"versions":["11.0.30"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.29"},{"fixed":"11.0.29.tuxcare0003"}]}],"versions":["11.0.29","11.0.29.tuxcare0001","11.0.29.tuxcare0002"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.27"},{"fixed":"10.0.27.tuxcare0004"}]}],"versions":["10.0.27","10.0.27.tuxcare00001","10.0.27.tuxcare0002","10.0.27.tuxcare0003"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.27"},{"fixed":"10.0.27.tuxcare0004"}]}],"versions":["10.0.27","10.0.27.tuxcare00001","10.0.27.tuxcare0002","10.0.27.tuxcare0003"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.28"},{"fixed":"10.0.28.tuxcare0003"}]}],"versions":["10.0.28","10.0.28.tuxcare0001","10.0.28.tuxcare0002"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.28"},{"fixed":"10.0.28.tuxcare0003"}]}],"versions":["10.0.28","10.0.28.tuxcare0001","10.0.28.tuxcare0002"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.61"},{"fixed":"9.4.61.tuxcare0003"}]}],"versions":["9.4.61","9.4.61.tuxcare0001","9.4.61.tuxcare0002"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.60"},{"fixed":"9.4.60.tuxcare0003"}]}],"versions":["9.4.60","9.4.60.tuxcare0001","9.4.60.tuxcare0002"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.26"},{"fixed":"10.0.26-tuxcare.3"}]}],"versions":["10.0.26","10.0.26-tuxcare.1","10.0.26-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.29"},{"fixed":"10.0.29.tuxcare0003"}]}],"versions":["10.0.29","10.0.29.tuxcare0001","10.0.29.tuxcare0002"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.28"},{"fixed":"11.0.28.tuxcare0004"}]}],"versions":["11.0.28","11.0.28-tuxcare.2","11.0.28.tuxcare0001","11.0.28.tuxcare0003"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.18"},{"fixed":"11.0.18-tuxcare.1"}]}],"versions":["11.0.18"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.18"},{"fixed":"11.0.18-tuxcare.1"}]}],"versions":["11.0.18"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.18"},{"fixed":"11.0.18-tuxcare.1"}]}],"versions":["11.0.18"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.19"},{"fixed":"11.0.19-tuxcare.4"}]}],"versions":["11.0.19","11.0.19-tuxcare.1","11.0.19-tuxcare.2","11.0.19-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.19"},{"fixed":"11.0.19-tuxcare.4"}]}],"versions":["11.0.19","11.0.19-tuxcare.1","11.0.19-tuxcare.2","11.0.19-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.19"},{"fixed":"11.0.19-tuxcare.4"}]}],"versions":["11.0.19","11.0.19-tuxcare.1","11.0.19-tuxcare.2","11.0.19-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.26"},{"fixed":"11.0.26-tuxcare.3"}]}],"versions":["11.0.26","11.0.26-tuxcare.1","11.0.26-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.26"},{"fixed":"11.0.26-tuxcare.3"}]}],"versions":["11.0.26","11.0.26-tuxcare.1","11.0.26-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.6"}]}],"versions":["9.4.50.v20221201","9.4.50.v20221201-tuxcare.1","9.4.50.v20221201-tuxcare.2","9.4.50.v20221201-tuxcare.3","9.4.50.v20221201-tuxcare.4","9.4.50.v20221201-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.6"}]}],"versions":["9.4.50.v20221201","9.4.50.v20221201-tuxcare.1","9.4.50.v20221201-tuxcare.2","9.4.50.v20221201-tuxcare.3","9.4.50.v20221201-tuxcare.4","9.4.50.v20221201-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.57.v20241219"},{"fixed":"9.4.57.v20241219-tuxcare.7"}]}],"versions":["9.4.57.v20241219","9.4.57.v20241219-tuxcare.1","9.4.57.v20241219-tuxcare.2","9.4.57.v20241219-tuxcare.3","9.4.57.v20241219-tuxcare.4","9.4.57.v20241219-tuxcare.5","9.4.57.v20241219-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.53.v20231009"},{"fixed":"9.4.53.v20231009-tuxcare.9"}]}],"versions":["9.4.53.v20231009","9.4.53.v20231009-tuxcare.1","9.4.53.v20231009-tuxcare.2","9.4.53.v20231009-tuxcare.3","9.4.53.v20231009-tuxcare.4","9.4.53.v20231009-tuxcare.5","9.4.53.v20231009-tuxcare.6","9.4.53.v20231009-tuxcare.7","9.4.53.v20231009-tuxcare.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.53.v20231009"},{"fixed":"9.4.53.v20231009-tuxcare.9"}]}],"versions":["9.4.53.v20231009","9.4.53.v20231009-tuxcare.1","9.4.53.v20231009-tuxcare.2","9.4.53.v20231009-tuxcare.3","9.4.53.v20231009-tuxcare.4","9.4.53.v20231009-tuxcare.5","9.4.53.v20231009-tuxcare.6","9.4.53.v20231009-tuxcare.7","9.4.53.v20231009-tuxcare.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.59"},{"fixed":"9.4.59.tuxcare0004"}]}],"versions":["9.4.59","9.4.59.tuxcare00001","9.4.59.tuxcare0002","9.4.59.tuxcare0003"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.58.v20250814"},{"fixed":"9.4.58.v20250814-tuxcare.8"}]}],"versions":["9.4.58.v20250814","9.4.58.v20250814-tuxcare.1","9.4.58.v20250814-tuxcare.2","9.4.58.v20250814-tuxcare.3","9.4.58.v20250814-tuxcare.4","9.4.58.v20250814-tuxcare.5","9.4.58.v20250814-tuxcare.6","9.4.58.v20250814-tuxcare.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.58.v20250814"},{"fixed":"9.4.58.v20250814-tuxcare.8"}]}],"versions":["9.4.58.v20250814","9.4.58.v20250814-tuxcare.1","9.4.58.v20250814-tuxcare.2","9.4.58.v20250814-tuxcare.3","9.4.58.v20250814-tuxcare.4","9.4.58.v20250814-tuxcare.5","9.4.58.v20250814-tuxcare.6","9.4.58.v20250814-tuxcare.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"Debian:13","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1","12.0.39-1","12.0.40-1","12.0.40-2"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.39-1"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1"]},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.50-4","9.4.50-4+deb12u1","9.4.50-4+deb12u2","9.4.50-4+deb12u3","9.4.51-1","9.4.51-2","9.4.52-1","9.4.53-1","9.4.54-1","9.4.55-1","9.4.56-1","9.4.57-0+deb12u1","9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0.v20161208"},{"last_affected":"9.4.58.v20250814"}]}],"versions":["9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.5.v20170502","9.4.5.v20180619","9.4.50.v20221201","9.4.51.v20230217","9.4.52.v20230823","9.4.53.v20231009","9.4.54.v20240208","9.4.55.v20240627","9.4.56.v20240826","9.4.57.v20241219","9.4.58.v20250814","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"last_affected":"10.0.26"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.17","10.0.18","10.0.19","10.0.2","10.0.20","10.0.21","10.0.22","10.0.23","10.0.24","10.0.25","10.0.26","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"last_affected":"11.0.26"}]}],"versions":["11.0.0","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.17","11.0.18","11.0.19","11.0.2","11.0.20","11.0.21","11.0.22","11.0.23","11.0.24","11.0.25","11.0.26","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.35"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.33","12.0.34","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.9"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7","12.1.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.22-2","9.2.22-3","9.2.23-1","9.4.15-1~18.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.18-2build2","9.4.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.39-3","9.4.44-2","9.4.44-3","9.4.44-4","9.4.45-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.51-2","9.4.53-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3.1","12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.58-1"]}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"}],"references":[{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99","tags":["Vendor Advisory","web","report"]},{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-7p3p-8qv8-m2vh","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6790","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project/issues/14870","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/pull/14871","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/pull/14897","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/pull/14970","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/commit/3e5a4daec196859b8886b6f67b1157dab47cdb6f","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/commit/67ba9e6b39661810123680d9c894e99a7940c73d","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/commit/cbca3076f7c914a232e7a8b22fa95fbf7e67a6cc","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.35","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7p3p-8qv8-m2vh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6790.json","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-6790","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6790","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6790","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-6790","description":"In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n  *  \n        \n      URI constructions (for example, for redirects -- this is typical for login pages)\n\n  *  \n        \n      Virtual host selection\n\n  *  \n        \n      Reverse proxying\n\n  *  \n        \n      Misleading logs\n\n  *  \n        \n      Etc.\n\n\n\n\n\n\nGiven that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.","status":"published","published":"2026-07-14T08:51:30.527Z","modified":"2026-07-14T12:20:35.13Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-43646","description":"In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n  *  \n        \n      URI constructions (for example, for redirects -- this is typical for login pages)\n\n  *  \n        \n      Virtual host selection\n\n  *  \n        \n      Reverse proxying\n\n  *  \n        \n      Misleading logs\n\n  *  \n        \n      Etc.\n\n\n\n\n\n\nGiven that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.","status":"published","published":"2026-07-14T08:51:30Z","modified":"2026-07-14T12:20:35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:00.696533Z"}],"ghsa":[{"id":"GHSA-7p3p-8qv8-m2vh","title":"Eclipse Jetty: HTTP Authority/Host mismatch","description":"#### Summary\n\nJetty currently accepts HTTP/2 and HTTP/3 requests where the regular\nHost header and the pseudo-header :authority\ndo not match. As a result, the same request can carry two different host identities\nthrough Jetty:\n\n- logic based on `HttpURI` / `Request.getServerName(request)` uses `:authority`\n- logic based on raw request headers continues to use `Host`\n\nThis creates a host/authority confusion condition that can break\nsecurity assumptions in higher layers.\n\nJetty already performs an explicit authority/Host consistency check on\nthe HTTP/1.1 path, but equivalent validation is missing on the HTTP/2\nand HTTP/3 paths.\n\n#### Security Impact\n\nThis issue is not inherently remote code execution, but it can become\nsecurity-relevant in deployments that rely on the request host for\nsecurity-sensitive decisions, including:\n\n- host-based access control\n- virtual host isolation\n- multi-tenant routing by hostname\n- login/logout/callback URL construction\n- reverse proxy and forwarded-header trust chains\n- auditing, cache keys, and absolute URL generation\n\nPotential consequences include:\n\n- bypass of host-based ACLs\n- virtual host or tenant isolation failures\n- incorrect or attacker-influenced redirect/callback targets\n- inconsistent proxy/downstream interpretation of the original target host\n- misleading logs and audit records\n\n#### Technical Root Cause\n\n1. On the HTTP/2 and HTTP/3 metadata builder paths:\n\n- `:authority` is parsed separately into authority/URI state\n- `Host` is preserved as a normal request header\n- the two values are not compared for consistency\n\n2. On the HTTP/2 and HTTP/3 server entry paths:\n\n- Jetty calls `ComplianceUtils.verify(httpCompliance, requestMetaData, listener)`\n- this verification does not enforce `MISMATCHED_AUTHORITY`\n\n3. On the HTTP/1.1 path:\n\n- Jetty explicitly checks whether authority and `Host` match\n- mismatches are rejected by default\n\n#### Relevant Code Locations\n\nHTTP/2 metadata builder:\n\n- `jetty-core/jetty-http2/jetty-http2-hpack/src/main/java/org/eclipse/jetty/http2/hpack/internal/MetaDataBuilder.java`\n\nHTTP/3 metadata builder:\n\n- `jetty-core/jetty-http3/jetty-http3-qpack/src/main/java/org/eclipse/jetty/http3/qpack/internal/metadata/MetaDataBuilder.java`\n\nHTTP/2 server entry:\n\n- `jetty-core/jetty-http2/jetty-http2-server/src/main/java/org/eclipse/jetty/http2/server/internal/HttpStreamOverHTTP2.java`\n\nHTTP/3 server entry:\n\n- `jetty-core/jetty-http3/jetty-http3-server/src/main/java/org/eclipse/jetty/http3/server/internal/HttpStreamOverHTTP3.java`\n\nShared HTTP compliance verification:\n\n- `jetty-core/jetty-http/src/main/java/org/eclipse/jetty/http/ComplianceUtils.java`\n\nHTTP/1.1 authority/Host consistency check:\n\n- `jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/HttpConnection.java`\n\nDefined but not enforced on H2/H3:\n\n- `jetty-core/jetty-http/src/main/java/org/eclipse/jetty/http/HttpCompliance.java`\n- violation: MISMATCHED_AUTHORITY\n\n#### Reproduction\n\nI reproduced this on local Jetty 12.1.9-SNAPSHOT source.\n\nMinimal reproduction steps:\n\n1. Start a Jetty HTTP/2 or HTTP/3 test server.\n2. Send a request with:\n    - :authority = localhost:\u003cport\u003e\n    - Host = evil.example:\u003cport\u003e\n3. In the request handler, inspect both:\n    - Request.getServerName(request)\n    - request.getHeaders().get(HttpHeader.HOST)\n4. Observe whether Jetty rejects the request or allows both values to remain visible.\nObserved result:\n    - HTTP/2: request is accepted and returns 200\n    - HTTP/3: request is accepted and returns 200\n    - the server can observe both:\n        - serverName=localhost\n        - hostHeader=evil.example:\u003cport\u003e\n\nThis shows that a single attacker-controlled request can preserve two conflicting host interpretations inside Jetty.\n\n#### Tests Used\n\n\nHTTP/2 rejection test:\n\n- `org.eclipse.jetty.http2.tests.HTTP2Test#testRejectMismatchedHostHeaderAndAuthority`\n\nHTTP/2 exploitability test:\n\n- `org.eclipse.jetty.http2.tests.HTTP2Test#testMismatchedHostHeaderAndAuthoritySplitsAuthorityFromHostHeader`\n\nHTTP/3 rejection test:\n\n- `org.eclipse.jetty.http3.tests.HandlerClientServerTest#testRejectMismatchedHostHeaderAndAuthority`\n\nHTTP/3 exploitability test:\n\n- `org.eclipse.jetty.http3.tests.HandlerClientServerTest#testMismatchedHostHeaderAndAuthoritySplitsAuthorityFromHostHeader`\n\n\nObserved behavior:\n\n- both rejection tests fail because Jetty returns 200 instead of 400\n- both exploitability tests pass, confirming that Jetty exposes different host values to different layers\n\n#### Project-Internal Evidence of Real Impact\n\nExamples:\n\n- `jetty-openid` uses `Request.getServerName(request)` to construct redirect URLs\n- `jetty-ee11-proxy` uses the raw `Host` header when building `Forwarded`\n\nThis indicates that the issue is not merely theoretical: Jetty’s own\necosystem already contains code paths where different host sources are\nused for different purposes.\n\n#### Affected Version\n\nConfirmed affected version:\n\n- 12.1.9-SNAPSHOT\n\nOther versions may also be affected if they share the same HTTP/2 /\nHTTP/3 request construction and compliance-validation logic. I have\nnot yet completed a historical version matrix and would recommend\nconfirming exact affected ranges from Jetty’s branch history.\n\n\n#### Suggested Fix\n\nRecommend adding HTTP/2 and HTTP/3 validation equivalent to the\nexisting HTTP/1.1 authority/Host consistency check:\n\n- if both :authority and regular Host are present\n    - normalize and compare them\n    - if they do not match, reject the request with 400 Bad Request\n    - route the failure through the existing MISMATCHED_AUTHORITY compliance mechanism\n\nAlso adding explicit HTTP/2 and HTTP/3 regression coverage for this case.\n\n#### Disclosure Status\n\n- not publicly disclosed\n- no public issue filed\n- shared only privately with the Jetty security contacts","status":"published","published":"2026-07-22T22:56:43Z","modified":"2026-07-22T22:56:44Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:40:51.375752Z"}],"nvd":[{"id":"CVE-2026-6790","description":"In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n  *  \n        \n      URI constructions (for example, for redirects -- this is typical for login pages)\n\n  *  \n        \n      Virtual host selection\n\n  *  \n        \n      Reverse proxying\n\n  *  \n        \n      Misleading logs\n\n  *  \n        \n      Etc.\n\n\n\n\n\n\nGiven that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.","status":"published","published":"2026-07-14T09:16:41.93Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:29.114188Z"}],"osv":[{"id":"CVE-2026-6790","description":"In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n  *  \n        \n      URI constructions (for example, for redirects -- this is typical for login pages)\n\n  *  \n        \n      Virtual host selection\n\n  *  \n        \n      Reverse proxying\n\n  *  \n        \n      Misleading logs\n\n  *  \n        \n      Etc.\n\n\n\n\n\n\nGiven that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.","status":"published","published":"2026-07-14T08:51:30.527Z","modified":"2026-10-28T02:30:41.855185862Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"DEBIAN-CVE-2026-6790","description":"In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).     This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).     This mismatch can cause a number of problems that may be classified as vulnerabilities such as:      *                  URI constructions (for example, for redirects -- this is typical for login pages)    *                  Virtual host selection    *                  Reverse proxying    *                  Misleading logs    *                  Etc.       Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.","status":"published","published":"2026-07-14T09:16:41.93Z","modified":"2026-11-04T06:00:08.558861739Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-04T06:29:21.687524Z"},{"id":"GHSA-7p3p-8qv8-m2vh","title":"Eclipse Jetty: HTTP Authority/Host mismatch","description":"#### Summary\n\nJetty currently accepts HTTP/2 and HTTP/3 requests where the regular\nHost header and the pseudo-header :authority\ndo not match. As a result, the same request can carry two different host identities\nthrough Jetty:\n\n- logic based on `HttpURI` / `Request.getServerName(request)` uses `:authority`\n- logic based on raw request headers continues to use `Host`\n\nThis creates a host/authority confusion condition that can break\nsecurity assumptions in higher layers.\n\nJetty already performs an explicit authority/Host consistency check on\nthe HTTP/1.1 path, but equivalent validation is missing on the HTTP/2\nand HTTP/3 paths.\n\n#### Security Impact\n\nThis issue is not inherently remote code execution, but it can become\nsecurity-relevant in deployments that rely on the request host for\nsecurity-sensitive decisions, including:\n\n- host-based access control\n- virtual host isolation\n- multi-tenant routing by hostname\n- login/logout/callback URL construction\n- reverse proxy and forwarded-header trust chains\n- auditing, cache keys, and absolute URL generation\n\nPotential consequences include:\n\n- bypass of host-based ACLs\n- virtual host or tenant isolation failures\n- incorrect or attacker-influenced redirect/callback targets\n- inconsistent proxy/downstream interpretation of the original target host\n- misleading logs and audit records\n\n#### Technical Root Cause\n\n1. On the HTTP/2 and HTTP/3 metadata builder paths:\n\n- `:authority` is parsed separately into authority/URI state\n- `Host` is preserved as a normal request header\n- the two values are not compared for consistency\n\n2. On the HTTP/2 and HTTP/3 server entry paths:\n\n- Jetty calls `ComplianceUtils.verify(httpCompliance, requestMetaData, listener)`\n- this verification does not enforce `MISMATCHED_AUTHORITY`\n\n3. On the HTTP/1.1 path:\n\n- Jetty explicitly checks whether authority and `Host` match\n- mismatches are rejected by default\n\n#### Relevant Code Locations\n\nHTTP/2 metadata builder:\n\n- `jetty-core/jetty-http2/jetty-http2-hpack/src/main/java/org/eclipse/jetty/http2/hpack/internal/MetaDataBuilder.java`\n\nHTTP/3 metadata builder:\n\n- `jetty-core/jetty-http3/jetty-http3-qpack/src/main/java/org/eclipse/jetty/http3/qpack/internal/metadata/MetaDataBuilder.java`\n\nHTTP/2 server entry:\n\n- `jetty-core/jetty-http2/jetty-http2-server/src/main/java/org/eclipse/jetty/http2/server/internal/HttpStreamOverHTTP2.java`\n\nHTTP/3 server entry:\n\n- `jetty-core/jetty-http3/jetty-http3-server/src/main/java/org/eclipse/jetty/http3/server/internal/HttpStreamOverHTTP3.java`\n\nShared HTTP compliance verification:\n\n- `jetty-core/jetty-http/src/main/java/org/eclipse/jetty/http/ComplianceUtils.java`\n\nHTTP/1.1 authority/Host consistency check:\n\n- `jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/HttpConnection.java`\n\nDefined but not enforced on H2/H3:\n\n- `jetty-core/jetty-http/src/main/java/org/eclipse/jetty/http/HttpCompliance.java`\n- violation: MISMATCHED_AUTHORITY\n\n#### Reproduction\n\nI reproduced this on local Jetty 12.1.9-SNAPSHOT source.\n\nMinimal reproduction steps:\n\n1. Start a Jetty HTTP/2 or HTTP/3 test server.\n2. Send a request with:\n    - :authority = localhost:\u003cport\u003e\n    - Host = evil.example:\u003cport\u003e\n3. In the request handler, inspect both:\n    - Request.getServerName(request)\n    - request.getHeaders().get(HttpHeader.HOST)\n4. Observe whether Jetty rejects the request or allows both values to remain visible.\nObserved result:\n    - HTTP/2: request is accepted and returns 200\n    - HTTP/3: request is accepted and returns 200\n    - the server can observe both:\n        - serverName=localhost\n        - hostHeader=evil.example:\u003cport\u003e\n\nThis shows that a single attacker-controlled request can preserve two conflicting host interpretations inside Jetty.\n\n#### Tests Used\n\n\nHTTP/2 rejection test:\n\n- `org.eclipse.jetty.http2.tests.HTTP2Test#testRejectMismatchedHostHeaderAndAuthority`\n\nHTTP/2 exploitability test:\n\n- `org.eclipse.jetty.http2.tests.HTTP2Test#testMismatchedHostHeaderAndAuthoritySplitsAuthorityFromHostHeader`\n\nHTTP/3 rejection test:\n\n- `org.eclipse.jetty.http3.tests.HandlerClientServerTest#testRejectMismatchedHostHeaderAndAuthority`\n\nHTTP/3 exploitability test:\n\n- `org.eclipse.jetty.http3.tests.HandlerClientServerTest#testMismatchedHostHeaderAndAuthoritySplitsAuthorityFromHostHeader`\n\n\nObserved behavior:\n\n- both rejection tests fail because Jetty returns 200 instead of 400\n- both exploitability tests pass, confirming that Jetty exposes different host values to different layers\n\n#### Project-Internal Evidence of Real Impact\n\nExamples:\n\n- `jetty-openid` uses `Request.getServerName(request)` to construct redirect URLs\n- `jetty-ee11-proxy` uses the raw `Host` header when building `Forwarded`\n\nThis indicates that the issue is not merely theoretical: Jetty’s own\necosystem already contains code paths where different host sources are\nused for different purposes.\n\n#### Affected Version\n\nConfirmed affected version:\n\n- 12.1.9-SNAPSHOT\n\nOther versions may also be affected if they share the same HTTP/2 /\nHTTP/3 request construction and compliance-validation logic. I have\nnot yet completed a historical version matrix and would recommend\nconfirming exact affected ranges from Jetty’s branch history.\n\n\n#### Suggested Fix\n\nRecommend adding HTTP/2 and HTTP/3 validation equivalent to the\nexisting HTTP/1.1 authority/Host consistency check:\n\n- if both :authority and regular Host are present\n    - normalize and compare them\n    - if they do not match, reject the request with 400 Bad Request\n    - route the failure through the existing MISMATCHED_AUTHORITY compliance mechanism\n\nAlso adding explicit HTTP/2 and HTTP/3 regression coverage for this case.\n\n#### Disclosure Status\n\n- not publicly disclosed\n- no public issue filed\n- shared only privately with the Jetty security contacts","status":"published","published":"2026-07-22T22:56:43Z","modified":"2026-09-10T03:51:11.09673136Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"UBUNTU-CVE-2026-6790","description":"In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as:   *       URI constructions (for example, for redirects -- this is typical for login pages)   *       Virtual host selection   *       Reverse proxying   *       Misleading logs   *       Etc. Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.","status":"published","published":"2026-07-14T09:16:00Z","modified":"2026-10-17T13:00:40.440910173Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"CLSA-2026-1779065207","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 9.4.62.tuxcare0001.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-30T19:45:22.253882231Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779065208","title":"TuxCare security update for org.eclipse.jetty:jetty-server (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-server to address 1 CVE. Fixed in 10.0.30.tuxcare0001.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-11-02T19:45:32.065493717Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1779065209","title":"TuxCare security update for org.eclipse.jetty:jetty-server (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-server to address 1 CVE. Fixed in 11.0.30.tuxcare0001.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-11-02T19:45:32.968311295Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1785291679","title":"TuxCare security update for org.eclipse.jetty:jetty-server (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-server to address 1 CVE. Fixed in 11.0.29.tuxcare0003.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-11-02T19:45:44.936155852Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1786356731","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 10.0.27.tuxcare0004.","status":"published","published":"2026-08-10T10:12:11Z","modified":"2026-11-02T19:45:48.816189577Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1786358468","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 10.0.28.tuxcare0003.","status":"published","published":"2026-08-10T10:41:08Z","modified":"2026-11-02T19:45:48.486707663Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1786441499","title":"TuxCare security update for org.eclipse.jetty:jetty-server (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-server to address 1 CVE. Fixed in 9.4.61.tuxcare0003.","status":"published","published":"2026-08-11T09:44:59Z","modified":"2026-10-30T19:45:31.052734289Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786441655","title":"TuxCare security update for org.eclipse.jetty:jetty-server (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-server to address 1 CVE. Fixed in 9.4.60.tuxcare0003.","status":"published","published":"2026-08-11T09:47:35Z","modified":"2026-10-30T19:45:31.039208546Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786467443","title":"TuxCare security update for org.eclipse.jetty:jetty-server (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-server to address 1 CVE. Fixed in 10.0.26-tuxcare.3.","status":"published","published":"2026-08-11T16:57:23Z","modified":"2026-11-02T19:45:53.459786233Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1786482291","title":"TuxCare security update for org.eclipse.jetty:jetty-server (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-server to address 1 CVE. Fixed in 10.0.29.tuxcare0003.","status":"published","published":"2026-08-11T21:04:51Z","modified":"2026-11-02T19:45:53.409467504Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1787658666","title":"TuxCare security update for org.eclipse.jetty:jetty-server (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-server to address 1 CVE. Fixed in 11.0.28.tuxcare0004.","status":"published","published":"2026-08-25T11:51:06Z","modified":"2026-11-02T19:45:57.924679298Z","updated_at":"2026-11-02T20:29:49.757752Z"},{"id":"CLSA-2026-1792753531","title":"TuxCare security update for 3 packages (4 CVEs)","description":"TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 11.0.18-tuxcare.1.","status":"published","published":"2026-10-23T11:05:31Z","modified":"2026-11-02T19:46:31.49054063Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792756836","title":"TuxCare security update for 3 packages (4 CVEs)","description":"TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 11.0.19-tuxcare.4.","status":"published","published":"2026-10-23T12:00:36Z","modified":"2026-11-02T19:46:31.630808482Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793132217","title":"TuxCare security update for 9 packages (5 CVEs)","description":"TuxCare rebuilt 9 packages to address 5 CVEs. Fixed in 12.0.22-tuxcare.1.","status":"published","published":"2026-10-27T20:16:57Z","modified":"2026-11-02T19:46:32.652202463Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793136455","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 11.0.26-tuxcare.3.","status":"published","published":"2026-10-27T21:27:35Z","modified":"2026-11-02T19:46:32.38091334Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793790043","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.4.50.v20221201-tuxcare.6.","status":"published","published":"2026-11-04T12:00:44Z","modified":"2026-11-04T14:45:05.828051472Z","updated_at":"2026-11-04T15:03:54.132276Z"},{"id":"CLSA-2026-1793796534","title":"TuxCare security update for org.eclipse.jetty:jetty-server (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-server to address 1 CVE. Fixed in 9.4.57.v20241219-tuxcare.7.","status":"published","published":"2026-11-04T13:48:55Z","modified":"2026-11-04T19:00:38.092073426Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1793798237","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.4.53.v20231009-tuxcare.9.","status":"published","published":"2026-11-04T14:17:18Z","modified":"2026-11-04T19:00:37.392216906Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1794235772","title":"TuxCare security update for org.eclipse.jetty:jetty-server (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-server to address 1 CVE. Fixed in 9.4.59.tuxcare0004.","status":"published","published":"2026-11-09T15:49:33Z","modified":"2026-11-09T19:15:11.029568664Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794244898","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.4.58.v20250814-tuxcare.8.","status":"published","published":"2026-11-09T18:21:39Z","modified":"2026-11-10T01:15:03.447684541Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794251641","title":"TuxCare security update for 5 packages (5 CVEs)","description":"TuxCare rebuilt 5 packages to address 5 CVEs. Fixed in 9.4.51.v20230217-tuxcare.2.","status":"published","published":"2026-11-09T20:14:02Z","modified":"2026-11-10T01:15:05.398922343Z","updated_at":"2026-11-10T01:43:20.132342Z"}]}}