TI-2026-05954 Aliases CVE-2026-6790 GHSA-7p3p-8qv8-m2vh

Improper input validation in Eclipse Jetty

LOW 30CWE-20Published 2026-07-14 · Updated 2026-07-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Partial Red Hat: 18 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying * Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0031 24th percentileScored 2026-11-07

Fix Partial org.eclipse.jetty:jetty-server (Maven): 12.0.35, 12.1.9Red Hat: 18 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Eclipse Foundation	Eclipse Jetty	9.4.0 – 9.4.60; 10.0.0 – 10.0.28; 11.0.0 – 11.0.28; 12.0.0 – 12.0.34; 12.1.0 – 12.1.8	—	No fix listed	CNA
—	org.eclipse.jetty:jetty-server (Maven)	9.4.0.v20161208 – 9.4.58.v20250814	—	No fix listed	GHSA-7p3p-8qv8-m2vh
—	org.eclipse.jetty:jetty-server (Maven)	10.0.0 – 10.0.26	—	No fix listed	GHSA-7p3p-8qv8-m2vh
—	org.eclipse.jetty:jetty-server (Maven)	11.0.0 – 11.0.26	—	No fix listed	GHSA-7p3p-8qv8-m2vh
—	org.eclipse.jetty:jetty-server (Maven)	12.0.0 to before 12.0.35	12.0.35	Patch available	GHSA-7p3p-8qv8-m2vh
—	org.eclipse.jetty:jetty-server (Maven)	12.1.0 to before 12.1.9	12.1.9	Patch available	GHSA-7p3p-8qv8-m2vh

Eclipse Jetty VendorEclipse Foundation Affected 9.4.0 – 9.4.60; 10.0.0 – 10.0.28; 11.0.0 – 11.0.28; 12.0.0 – 12.0.34; 12.1.0 – 12.1.8 Fixed in — No fix listed CNA
org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.0.v20161208 – 9.4.58.v20250814 Fixed in — No fix listed GHSA-7p3p-8qv8-m2vh
org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 10.0.0 – 10.0.26 Fixed in — No fix listed GHSA-7p3p-8qv8-m2vh
org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 11.0.0 – 11.0.26 Fixed in — No fix listed GHSA-7p3p-8qv8-m2vh
org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 12.0.0 to before 12.0.35 Fixed in 12.0.35 Patch available GHSA-7p3p-8qv8-m2vh
org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 12.1.0 to before 12.1.9 Fixed in 12.1.9 Patch available GHSA-7p3p-8qv8-m2vh

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:eclipse:jetty::::::::	9.4.0 to before 9.4.61; 10.0.0 to before 10.0.29; 11.0.0 to before 11.0.29; 12.0.0 to before 12.0.35; 12.1.0 to before 12.1.9	Vulnerable	Eclipse Foundation

cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.4.0 to before 9.4.61; 10.0.0 to before 10.0.29; 11.0.0 to before 11.0.29; 12.0.0 to before 12.0.35; 12.1.0 to before 12.1.9 Vulnerable ·Eclipse Foundation

Remediation

Fix · GHSA-7p3p-8qv8-m2vh org.eclipse.jetty:jetty-server (Maven) Fixed in 12.0.35 Advisory →
Fix · GHSA-7p3p-8qv8-m2vh org.eclipse.jetty:jetty-server (Maven) Fixed in 12.1.9 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Developer Tools and Services	Affected	No fix yet: Fix deferred
Red Hat AMQ Broker 7	Affected	No fix yet: Fix deferred
Red Hat Data Grid 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred
Red Hat Offline Knowledge Portal	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred
Red Hat Satellite 6	Affected	No fix yet: Fix deferred
Red Hat Single Sign-On 7	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel - HawtIO 4	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred
Red Hat build of Apicurio Registry 3	Affected	No fix yet: Fix deferred
Red Hat build of Debezium 3	Affected	No fix yet: Fix deferred
streams for Apache Kafka 2	Affected	No fix yet: Fix deferred
streams for Apache Kafka 3	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-6790
2026-10-03 Alias added: GHSA-7p3p-8qv8-m2vh

References

Advisory 2

Other 11

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3

See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences