CVE-2026-6790
Full vulnerability record from the local CVENow database.
Description
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying * Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.
Severity
MEDIUM
CVSS score
5.3
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-14 09:16:41.930000
Last modified
2026-10-24 21:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-6790",
"sourceIdentifier": "[email protected]",
"published": "2026-07-14T09:16:41.930",
"lastModified": "2026-10-24T21:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n * \n \n URI constructions (for example, for redirects -- this is typical for login pages)\n\n * \n \n Virtual host selection\n\n * \n \n Reverse proxying\n\n * \n \n Misleading logs\n\n * \n \n Etc.\n\n\n\n\n\n\nGiven that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant."
},
{
"lang": "es",
"value": "En Eclipse Jetty, para solicitudes HTTP/1, HTTP/2 y HTTP/3, no existe una verificación estricta de que la autoridad de la solicitud (host y puerto) coincida con lo proporcionado en el encabezado Host (si está presente).\n\nEsto no se aplicaba en RFC HTTP anteriores (por ejemplo, en RFC 2616), pero sí en los RFC más recientes (9110 y 9112).\n\nEsta falta de coincidencia puede causar una serie de problemas que pueden clasificarse como vulnerabilidades, tales como:\n\n * \n \n Construcciones de URI (por ejemplo, para redirecciones -- esto es típico en páginas de inicio de sesión)\n\n * \n \n Selección de host virtual\n\n * \n \n Proxy inverso\n\n * \n \n Registros engañosos\n\n * \n \n Etc.\n\nDado que los RFC más recientes requieren que la autoridad de la solicitud y el encabezado Host deben coincidir, Jetty debería aplicar este invariante."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Eclipse Foundation",
"product": "Eclipse Jetty",
"defaultStatus": "unaffected",
"repo": "https://github.com/jetty/jetty.project",
"versions": [
{
"version": "9.4.0",
"lessThanOrEqual": "9.4.60",
"versionType": "semver",
"status": "affected"
},
{
"version": "10.0.0",
"lessThanOrEqual": "10.0.28",
"versionType": "semver",
"status": "affected"
},
{
"version": "11.0.0",
"lessThanOrEqual": "11.0.28",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.0.0",
"lessThanOrEqual": "12.0.34",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.1.0",
"lessThanOrEqual": "12.1.8",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-14T12:18:58.528202Z",
"id": "CVE-2026-6790",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
"versionStartIncluding": "9.4.0",
"versionEndExcluding": "9.4.61",
"matchCriteriaId": "EE3C7B48-2010-4031-8B0A-6895F39250E0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.0.0",
"versionEndExcluding": "10.0.29",
"matchCriteriaId": "429939D6-D788-4755-B4DF-DEAEDC8973F9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.0.0",
"versionEndExcluding": "11.0.29",
"matchCriteriaId": "474C24C9-B404-4D57-A69D-6F76009C5772"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.0.0",
"versionEndExcluding": "12.0.35",
"matchCriteriaId": "655AA819-8D55-40C7-BCF3-F7D2AC085C41"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.1.0",
"versionEndExcluding": "12.1.9",
"matchCriteriaId": "FF2AE57E-99D5-4181-A5B6-77A5FFBEB3F1"
}
]
}
]
}
],
"references": [
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}