Executive brief
Eclipse Jetty, a widely used web server and servlet container, is vulnerable to a host confusion issue when processing HTTP/2 and HTTP/3 requests. An attacker can send a request containing conflicting host identities, which may cause the server to use one identity for security checks and another for application logic. This can lead to the bypass of access controls, incorrect routing in multi-tenant environments, or the generation of malicious redirect links.
Technical details
A host/authority mismatch vulnerability exists in Eclipse Jetty's HTTP/2 and HTTP/3 implementations. While Jetty enforces consistency between these values in HTTP/1.1, it fails to do so in the MetaDataBuilder and server entry paths for newer protocols. An attacker can provide a ':authority' pseudo-header that differs from the 'Host' header; Jetty's internal logic may then use different values depending on whether it calls Request.getServerName() or accesses raw headers. This inconsistency can be exploited to bypass host-based ACLs, break virtual host isolation, or influence redirect URL construction in components like jetty-openid. The issue is resolved by enforcing the MISMATCHED_AUTHORITY compliance check in HTTP/2 and HTTP/3 paths.
Affected products
- Eclipse jetty-server >= 9.4.0, <= 9.4.60; >= 10.0.0, <= 10.0.28; >= 11.0.0, <= 11.0.28; >= 12.0.0, <= 12.0.34; >= 12.1.0, <= 12.1.8
Timeline
- 2026-07-13: disclosed: Initial report to Jetty security team
- 2026-07-14: advisory: NVD publication date
- 2026-07-22: patched: GitHub Advisory reviewed and updated with patched versions