CVE-2026-6790
published 2026-07-14CVE-2026-6790: In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.20%
9.8th percentile
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying * Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | puppetserver | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| eclipse | jetty | >= 10.0.0 < 10.0.29 | 10.0.29 |
| eclipse | jetty | >= 11.0.0 < 11.0.29 | 11.0.29 |
| eclipse | jetty | >= 12.0.0 < 12.0.35 | 12.0.35 |
| eclipse | jetty | >= 12.1.0 < 12.1.9 | 12.1.9 |
| eclipse | jetty | >= 9.4.0 < 9.4.61 | 9.4.61 |
| eclipse_foundation | eclipse_jetty | 10.0.0 – 10.0.28 | — |
| eclipse_foundation | eclipse_jetty | 11.0.0 – 11.0.28 | — |
| eclipse_foundation | eclipse_jetty | 12.0.0 – 12.0.34 | — |
| eclipse_foundation | eclipse_jetty | 12.1.0 – 12.1.8 | — |
| eclipse_foundation | eclipse_jetty | 9.4.0 – 9.4.60 | — |
| jenkins | jenkins | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
| offline-knowledge-portal | rhokp-rhel9 | — | — |
| pki-core_10.6 | resteasy | — | — |
| pki-deps_10.6 | resteasy | — | — |
| redhat | resteasy | — | — |
| rhoai | odh-spark-operator-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jetty: Jetty: Improper Host header validation can lead to request routing issues
vendor_redhat·2026-07-14·CVSS 5.3
CVE-2026-6790 [MEDIUM] CWE-940 jetty: Jetty: Improper Host header validation can lead to request routing issues
jetty: Jetty: Improper Host header validation can lead to request routing issues
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).
This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).
This mismatch can cause a number of problems that may be classified as vulnerabilities such as:
*
URI constructions (for example, for redirects -- this is typical for login pages)
*
Virtual host selection
*
Reverse proxying
*
Misleading logs
*
Etc.
Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.
A flaw was found in Eclipse Jetty. The server doe
GHSA
Eclipse Jetty: HTTP Authority/Host mismatch
ghsa·2026-07-22
CVE-2026-6790 [MEDIUM] CWE-20 Eclipse Jetty: HTTP Authority/Host mismatch
Eclipse Jetty: HTTP Authority/Host mismatch
#### Summary
Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular
Host header and the pseudo-header :authority
do not match. As a result, the same request can carry two different host identities
through Jetty:
- logic based on `HttpURI` / `Request.getServerName(request)` uses `:authority`
- logic based on raw request headers continues to use `Host`
This creates a host/authority confusion condition that can break
security assumptions in higher layers.
Jetty already performs an explicit authority/Host consistency check on
the HTTP/1.1 path, but equivalent validation is missing on the HTTP/2
and HTTP/3 paths.
#### Security Impact
This issue is not inherently remote code execution, but it can become
security-relevant in deploym
VulDB
Eclipse Jetty up to 12.1.8 Authority input validation (WID-SEC-2026-2314)
vuldb·2026-07-14·CVSS 5.3
CVE-2026-6790 [MEDIUM] Eclipse Jetty up to 12.1.8 Authority input validation (WID-SEC-2026-2314)
A vulnerability labeled as critical has been found in Eclipse Jetty up to 9.4.60/10.0.28/11.0.28/12.0.34/12.1.8. This affects an unknown function of the component Authority. The manipulation results in improper input validation.
This vulnerability is identified as CVE-2026-6790. The attack can be executed remotely. There is not any exploit available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-6790 resteasy: Jetty: Improper Host header validation can lead to request routing issues [fedora-all]
bugzilla·2026-08-05·CVSS 5.3
CVE-2026-6790 [MEDIUM] CVE-2026-6790 resteasy: Jetty: Improper Host header validation can lead to request routing issues [fedora-all]
CVE-2026-6790 resteasy: Jetty: Improper Host header validation can lead to request routing issues [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).
This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).
This mismatch can cause a number of problems that may be classified as vulnerabilities such as:
*
URI constructions (for example, for redirects -- this is typic
Bugzilla
CVE-2026-6790 python-avro: Jetty: Improper Host header validation can lead to request routing issues [fedora-all]
bugzilla·2026-08-05·CVSS 5.3
CVE-2026-6790 [MEDIUM] CVE-2026-6790 python-avro: Jetty: Improper Host header validation can lead to request routing issues [fedora-all]
CVE-2026-6790 python-avro: Jetty: Improper Host header validation can lead to request routing issues [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).
This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).
This mismatch can cause a number of problems that may be classified as vulnerabilities such as:
*
URI constructions (for example, for redirects -- this is ty
Bugzilla
CVE-2026-6790 maven4: Jetty: Improper Host header validation can lead to request routing issues [fedora-all]
bugzilla·2026-08-05·CVSS 5.3
CVE-2026-6790 [MEDIUM] CVE-2026-6790 maven4: Jetty: Improper Host header validation can lead to request routing issues [fedora-all]
CVE-2026-6790 maven4: Jetty: Improper Host header validation can lead to request routing issues [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).
This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).
This mismatch can cause a number of problems that may be classified as vulnerabilities such as:
*
URI constructions (for example, for redirects -- this is typical
Bugzilla
CVE-2026-6790 jetty: Jetty: Improper Host header validation can lead to request routing issues
bugzilla·2026-07-14·CVSS 5.3
CVE-2026-6790 [MEDIUM] CVE-2026-6790 jetty: Jetty: Improper Host header validation can lead to request routing issues
CVE-2026-6790 jetty: Jetty: Improper Host header validation can lead to request routing issues
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).
This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).
This mismatch can cause a number of problems that may be classified as vulnerabilities such as:
*
URI constructions (for example, for redirects -- this is typical for login pages)
*
Virtual host selection
*
Reverse proxying
*
Misleading logs
*
Etc.
Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.
2026-07-14
Published