Jetty Host Header Authority Mismatch Vulnerability
CVE-2026-6790 Published on July 14, 2026
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying * Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.
Vulnerability Analysis
CVE-2026-6790 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Products Associated with CVE-2026-6790
Want to know whenever a new CVE is published for Eclipse Jetty? stack.watch will email you.
Affected Versions
Eclipse Foundation Eclipse Jetty:- Version 9.4.0, <= 9.4.60 is affected.
- Version 10.0.0, <= 10.0.28 is affected.
- Version 11.0.0, <= 11.0.28 is affected.
- Version 12.0.0, <= 12.0.34 is affected.
- Version 12.1.0, <= 12.1.8 is affected.