CVE-2026-6790

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-6790
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6790.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-6790
Downstream
Published
2026-07-14T08:51:30.527Z
Modified
2026-07-16T03:48:47.678878723Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).

This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).

This mismatch can cause a number of problems that may be classified as vulnerabilities such as:

  • URI constructions (for example, for redirects -- this is typical for login pages)

  • Virtual host selection

  • Reverse proxying

  • Misleading logs

  • Etc.

Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.

Database specific 
{
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6790.json",
    "cna_assigner": "eclipse",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "9.4.0"
                },
                {
                    "last_affected": "9.4.60"
                },
                {
                    "introduced": "10.0.0"
                },
                {
                    "last_affected": "10.0.28"
                },
                {
                    "introduced": "11.0.0"
                },
                {
                    "last_affected": "11.0.28"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/jetty/jetty.project

Affected ranges

Type
GIT
Repo
https://github.com/jetty/jetty.project
Events
Introduced
28100e8da711e44c0722ed10bd413ae862497539
Fixed
ae9286497b46fd709861e330fb364408a946d6e5
Introduced
c8372b65bd15404de1444d68902c0455a3a69b64
Fixed
b1fb145d4b0ea34d7636012359604367f4de7496
Database specific 
{
    "cpe": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.0.35"
        },
        {
            "introduced": "12.1.0"
        },
        {
            "fixed": "12.1.9"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

jetty-12.*
jetty-12.0.0x
jetty-12.0.14
jetty-12.0.15
jetty-12.0.19
jetty-12.0.22
jetty-12.0.23
jetty-12.0.30
jetty-12.0.31
jetty-12.0.5
jetty-12.0.6
jetty-12.1.0.beta1
jetty-12.1.2
jetty-12.1.4
jetty-12.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6790.json"