Medium severity · published Jul 14, 2026
CVE-2026-6790
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).
This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).
This mismatch can cause a number of problems that may be classified as vulnerabilities such as:
*
URI constructions (for example, for redirects -- this is typical for login pages)
*
Virtual host selection
*
Reverse proxying
*
Misleading logs
*
Etc.
Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EJ
Eclipse Jetty · Eclipse Foundation
9.4.0 through 9.4.60; 10.0.0 through 10.0.28; 11.0.0 through 11.0.28; 12.0.0 through 12.0.34; 12.1.0 through 12.1.8 · source: vendor
JE
Jetty · Eclipse
9.4.0 before 9.4.61; 10.0.0 before 10.0.29; 11.0.0 before 11.0.29; 12.0.0 before 12.0.35; 12.1.0 before 12.1.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6790
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6790
Vendor Advisory
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99
More from Eclipse Jetty
9.1
CVE-2026-10050
Digest authentication lossy encoding
9.1
CVE-2026-2332
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
8.7
CVE-2026-12611
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to…
8.7
CVE-2026-19204
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the…
8.3
CVE-2026-19203
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially…