Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Jetty web server may accept mismatched host headers

CVE-2026-6790 · published 3 months ago
Summary

Jetty servers provided by Debian and the Eclipse project can receive web requests where the host name in the request does not match the host name shown in the request header. This can cause redirects, virtual‑host selection, proxy handling and log entries to behave incorrectly, potentially exposing your site to misuse. Upgrade to a Jetty version that checks the host name or configure Jetty to reject requests with inconsistent host information.

What to do
  • Update eclipse org.eclipse.jetty:jetty-server to version 12.0.35.
  • Update eclipse org.eclipse.jetty:jetty-server to version 12.1.9.
Affected software
Ecosystem VendorProductAffected versions
Debian:13 debian jetty12 All versions
Debian:14 debian jetty12 All versions
Debian:11 debian jetty9 All versions
Debian:12 debian jetty9 All versions
Debian:13 debian jetty9 All versions
Debian:14 debian jetty9 All versions
– eclipse foundation eclipse jetty <= 9.4.60
maven eclipse org.eclipse.jetty:jetty-server >= 9.4.0.v20161208, <= 9.4.58.v20250814
>= 10.0.0, <= 10.0.26
>= 11.0.0, <= 11.0.26
>= 12.0.0, <= 12.0.34
>= 12.1.0, <= 12.1.8
Fix: upgrade to 12.0.35
– eclipse jetty >= 9.4.0, < 9.4.61
>= 10.0.0, < 10.0.29
>= 11.0.0, < 11.0.29
>= 12.0.0, < 12.0.35
>= 12.1.0, < 12.1.9
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Ubuntu:16.04:LTS canonical jetty9 All versions
Ubuntu:26.10 canonical jetty12 All versions
Original advisory text
Eclipse Jetty: HTTP Authority/Host mismatch
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying * Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published14 Jul 2026
Updated31 Oct 2026
First seen14 Jul 2026
Sources
DEBIAN-CVE-2026-6790 · OSV
CVE-2026-6790 · NVD
CVE-2026-6790 · MITRE
GHSA-7p3p-8qv8-m2vh · GHSA
UBUNTU-CVE-2026-6790 · OSV
CVE-2026-6790 · OSV
Track software like this
Free during beta