CVE-2026-6790: Eclipse Jetty host authority and Host header mismatch

CVE-2026-6790 · Severity: medium · CVSS 5.3 · Published 2026-07-14

Eclipse Jetty, a widely used web server and servlet container, is vulnerable to a host confusion issue when processing HTTP/2 and HTTP/3 requests. An attacker can send a request containing conflicting host identities, which may cause the server to use one identity for security checks and another for application logic. This can lead to the bypass of access controls, incorrect routing in multi-tenant environments, or the generation of malicious redirect links.

Technologies: Eclipse Foundation Jetty, org.eclipse.jetty:jetty-server (Maven). Vendors: Eclipse Foundation, Maven.

Quick answers

Is CVE-2026-6790 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6790 being exploited in the wild.
How severe is CVE-2026-6790?
Medium severity, with a CVSS score of 5.3, published 14 July 2026.
Which products and versions are affected?
Eclipse Foundation Jetty >= 9.4.0, <= 9.4.60; >= 10.0.0, <= 10.0.28; >= 11.0.0, <= 11.0.28; >= 12.0.0, <= 12.0.34; >= 12.1.0, <= 12.1.8, 9.4.0 to 9.4.60, 10.0.0 to 10.0.28, 11.0.0 to 11.0.28, 12.0.0 to 12.0.34, 12.1.0 to 12.1.8; org.eclipse.jetty:jetty-server (Maven) ECOSYSTEM:introduced=9.4.0.v20161208,last_affected=9.4.58.v20250814.
Is there a fix for CVE-2026-6790?
A patch was published on 2026-07-22: GitHub Advisory reviewed and updated with patched versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6790 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-6790?
Check whether you run Eclipse Foundation Jetty or org.eclipse.jetty:jetty-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A host/authority mismatch vulnerability exists in Eclipse Jetty's HTTP/2 and HTTP/3 implementations. While Jetty enforces consistency between these values in HTTP/1.1, it fails to do so in the MetaDataBuilder and server entry paths for newer protocols. An attacker can provide a ':authority' pseudo-header that differs from the 'Host' header; Jetty's internal logic may then use different values depending on whether it calls Request.getServerName() or accesses raw headers. This inconsistency can be exploited to bypass host-based ACLs, break virtual host isolation, or influence redirect URL construction in components like jetty-openid. The issue is resolved by enforcing the MISMATCHED_AUTHORITY compliance check in HTTP/2 and HTTP/3 paths.

Affected products

  • Eclipse jetty-server >= 9.4.0, <= 9.4.60; >= 10.0.0, <= 10.0.28; >= 11.0.0, <= 11.0.28; >= 12.0.0, <= 12.0.34; >= 12.1.0, <= 12.1.8

Identifiers

  • CVE-2026-6790
  • GHSA-7p3p-8qv8-m2vh

Timeline

  • 2026-07-13: disclosed: Initial report to Jetty security team
  • 2026-07-14: advisory: NVD publication date
  • 2026-07-22: patched: GitHub Advisory reviewed and updated with patched versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.