CVE-2026-77711
published 2026-10-15CVE-2026-77711: When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client…
PriorityP355high8.2CVSS 4.0
AVNACLATPPRNUINVCHVINVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.32%
23.7th percentile
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).
The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| eclipse_foundation | eclipse_jetty | 10.0.0 – 10.0.32 | — |
| eclipse_foundation | eclipse_jetty | 11.0.0 – 11.0.32 | — |
| eclipse_foundation | eclipse_jetty | 12.0.0 – 12.0.38 | — |
| eclipse_foundation | eclipse_jetty | 12.1.0 – 12.1.12 | — |
| eclipse_foundation | eclipse_jetty | 9.4.0 – 9.4.64 | — |
| offline-knowledge-portal | rhokp-rhel9 | — | — |
| rhoai | odh-spark-operator-rhel9 | — | — |
CVSS provenance
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).
ghsa_unreviewed·2026-10-15
CVE-2026-77711 [HIGH] CWE-200 When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).
The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.
Red Hat
org.eclipse.jetty/jetty-client: jetty-client: Information disclosure via improper proxy authentication handling
vendor_redhat·2026-10-15·CVSS 8.2
CVE-2026-77711 [HIGH] CWE-201 org.eclipse.jetty/jetty-client: jetty-client: Information disclosure via improper proxy authentication handling
org.eclipse.jetty/jetty-client: jetty-client: Information disclosure via improper proxy authentication handling
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).
The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.
A flaw was found in Eclipse Jetty's HttpClient. A malicious destination server can cause an information disclosure of proxy authentication credentials when client requests are routed through a forward proxy. By returning a proxy authentication challenge, the server misleads the client into believing the response came from the proxy,
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-77711 jetty: jetty-client: Information disclosure via improper proxy authentication handling [fedora-all]
bugzilla·2026-10-16·CVSS 8.2
CVE-2026-77711 [HIGH] CVE-2026-77711 jetty: jetty-client: Information disclosure via improper proxy authentication handling [fedora-all]
CVE-2026-77711 jetty: jetty-client: Information disclosure via improper proxy authentication handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).
The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.
Bugzilla
CVE-2026-77711 org.eclipse.jetty/jetty-client: jetty-client: Information disclosure via improper proxy authentication handling
bugzilla·2026-10-15·CVSS 8.2
CVE-2026-77711 [HIGH] CVE-2026-77711 org.eclipse.jetty/jetty-client: jetty-client: Information disclosure via improper proxy authentication handling
CVE-2026-77711 org.eclipse.jetty/jetty-client: jetty-client: Information disclosure via improper proxy authentication handling
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).
The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.
2026-10-15
Published