CVE-2026-6790: Eclipse Jetty HTTP Authority/Host Mismatch Vulnerability
Summary
CVE-2026-6790: Eclipse Jetty: HTTP Authority/Host mismatch. Affects org.eclipse.jetty:jetty-server across 5 version ranges.
>= 9.4.0.v20161208, <= 9.4.58.v20250814
>= 10.0.0, <= 10.0.26
>= 11.0.0, <= 11.0.26
>= 12.0.0, < 12.0.35
>= 12.1.0, < 12.1.9
Fixed in 12.0.35 or 12.1.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Eclipse Jetty is a widely used open-source Java-based web server and servlet container that provides a robust platform for developing and deploying web applications. It supports various protocols, including HTTP/2 and HTTP/3, and is known for its scalability and performance. However, a recent vulnerability has been identified that affects how Jetty handles HTTP/2 and HTTP/3 requests, specifically regarding the mismatch between the Host header and the :authority pseudo-header.
Vulnerability Detail
The vulnerability arises from Jetty's acceptance of HTTP/2 and HTTP/3 requests where the Host header and the :authority pseudo-header do not match. This inconsistency can lead to security issues, as different parts of the application may interpret the request's host identity differently. The lack of validation for authority and Host consistency in HTTP/2 and HTTP/3 can result in host-based access control failures, virtual host isolation issues, and misleading logs, potentially allowing attackers to exploit these discrepancies for malicious purposes.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 12.0.0, < 12.0.3512.0.35 -
>= 12.1.0, < 12.1.912.1.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement a reverse proxy that performs strict validation of the Host header and :authority pseudo-header before forwarding requests to Jetty. This can help mitigate the risk until an official patch is applied.
Conclusion
CVE-2026-6790 presents a significant vulnerability in Eclipse Jetty, affecting how HTTP/2 and HTTP/3 requests are processed. It is crucial for users to update to the latest patched versions to mitigate potential security risks. Implementing workarounds and utilizing tools like Vulert can help ensure your applications remain secure.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
CVE-2026-6790 is a vulnerability in Eclipse Jetty that allows HTTP/2 and HTTP/3 requests to have mismatched Host headers and :authority pseudo-headers, potentially leading to security issues.
This vulnerability can lead to host-based access control failures, virtual host isolation issues, and misleading logs, which may allow attackers to exploit these discrepancies.
Affected versions include Jetty 9.4.0.v20161208 to 9.4.58.v20250814, 10.0.0 to 10.0.26, 11.0.0 to 11.0.26, and 12.0.0 to 12.0.34.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By simply using your pom.xml, you can check if your application is affected without needing to access the code or installation.
The CVSS score of CVE-2026-6790 is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
