cve-2026-6790

{
  "cvss": 5.3,
  "datePublished": "2026-07-14T09:16:41.930",
  "dateUpdated": "2026-10-24T21:10:00.130",
  "description": "In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n  *  \n        \n      URI constructions (for example, for redirects -- this is typical for login pages)\n\n  *  \n        \n      Virtual host selection\n\n  *  \n        \n      Reverse proxying\n\n  *  \n        \n      Misleading logs\n\n  *  \n        \n      Etc.\n\n\n\n\n\n\nGiven that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.",
  "id": "CVE-2026-6790",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Eclipse Jetty",
            "repo": "https://github.com/jetty/jetty.project",
            "vendor": "Eclipse Foundation",
            "versions": [
              {
                "lessThanOrEqual": "9.4.60",
                "status": "affected",
                "version": "9.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "10.0.28",
                "status": "affected",
                "version": "10.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "11.0.28",
                "status": "affected",
                "version": "11.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "12.0.34",
                "status": "affected",
                "version": "12.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "12.1.8",
                "status": "affected",
                "version": "12.1.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "emo@eclipse.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "EE3C7B48-2010-4031-8B0A-6895F39250E0",
                "versionEndExcluding": "9.4.61",
                "versionStartIncluding": "9.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "429939D6-D788-4755-B4DF-DEAEDC8973F9",
                "versionEndExcluding": "10.0.29",
                "versionStartIncluding": "10.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "474C24C9-B404-4D57-A69D-6F76009C5772",
                "versionEndExcluding": "11.0.29",
                "versionStartIncluding": "11.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "655AA819-8D55-40C7-BCF3-F7D2AC085C41",
                "versionEndExcluding": "12.0.35",
                "versionStartIncluding": "12.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "FF2AE57E-99D5-4181-A5B6-77A5FFBEB3F1",
                "versionEndExcluding": "12.1.9",
                "versionStartIncluding": "12.1.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n  *  \n        \n      URI constructions (for example, for redirects -- this is typical for login pages)\n\n  *  \n        \n      Virtual host selection\n\n  *  \n        \n      Reverse proxying\n\n  *  \n        \n      Misleading logs\n\n  *  \n        \n      Etc.\n\n\n\n\n\n\nGiven that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant."
      },
      {
        "lang": "es",
        "value": "En Eclipse Jetty, para solicitudes HTTP/1, HTTP/2 y HTTP/3, no existe una verificación estricta de que la autoridad de la solicitud (host y puerto) coincida con lo proporcionado en el encabezado Host (si está presente).\n\nEsto no se aplicaba en RFC HTTP anteriores (por ejemplo, en RFC 2616), pero sí en los RFC más recientes (9110 y 9112).\n\nEsta falta de coincidencia puede causar una serie de problemas que pueden clasificarse como vulnerabilidades, tales como:\n\n  *  \n        \n      Construcciones de URI (por ejemplo, para redirecciones -- esto es típico en páginas de inicio de sesión)\n\n  *  \n        \n      Selección de host virtual\n\n  *  \n        \n      Proxy inverso\n\n  *  \n        \n      Registros engañosos\n\n  *  \n        \n      Etc.\n\nDado que los RFC más recientes requieren que la autoridad de la solicitud y el encabezado Host deben coincidir, Jetty debería aplicar este invariante."
      }
    ],
    "id": "CVE-2026-6790",
    "lastModified": "2026-10-24T21:10:00.130",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4,
          "source": "emo@eclipse.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-6790",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-07-14T12:18:58.528202Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-07-14T09:16:41.930",
    "references": [
      {
        "source": "emo@eclipse.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99"
      }
    ],
    "sourceIdentifier": "emo@eclipse.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-20"
          }
        ],
        "source": "emo@eclipse.org",
        "type": "Secondary"
      }
    ]
  },
  "severity": "MEDIUM",
  "source": "nvd",
  "title": "In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host a..."
}