CVE-2026-6790

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6790", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2026-04-21T13:47:52.520Z", "datePublished": "2026-07-14T08:51:30.527Z", "dateUpdated": "2026-07-14T12:20:35.130Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-07-14T08:51:30.527Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20", "type": "CWE"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "repo": "https://github.com/jetty/jetty.project", "versions": [{"status": "affected", "version": "9.4.0", "lessThanOrEqual": "9.4.60", "versionType": "semver"}, {"status": "affected", "version": "10.0.0", "lessThanOrEqual": "10.0.28", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThanOrEqual": "11.0.28", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThanOrEqual": "12.0.34", "versionType": "semver"}, {"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n * \n \n URI constructions (for example, for redirects -- this is typical for login pages)\n\n * \n \n Virtual host selection\n\n * \n \n Reverse proxying\n\n * \n \n Misleading logs\n\n * \n \n Etc.\n\n\n\n\n\n\nGiven that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the <code>Host</code> header (if present).</p>\n<p>This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).</p>\n<p>This mismatch can cause a number of problems that may be classified as vulnerabilities such as:</p>\n<ul>\n<li>\n \n URI constructions (for example, for redirects -- this is typical for login pages)</li>\n<li>\n \n Virtual host selection</li>\n<li>\n \n Reverse proxying</li>\n<li>\n \n Misleading logs</li>\n<li>\n \n Etc.</li>\n</ul>\n<p>Given that the latest RFCs require that request authority and <code>Host</code> header must match, Jetty should enforce this invariant.</p>"}]}], "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T12:18:58.528202Z", "id": "CVE-2026-6790", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T12:20:35.130Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6790", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T12:18:58.528202Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T12:20:30.586Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/jetty/jetty.project", "vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "versions": [{"status": "affected", "version": "9.4.0", "versionType": "semver", "lessThanOrEqual": "9.4.60"}, {"status": "affected", "version": "10.0.0", "versionType": "semver", "lessThanOrEqual": "10.0.28"}, {"status": "affected", "version": "11.0.0", "versionType": "semver", "lessThanOrEqual": "11.0.28"}, {"status": "affected", "version": "12.0.0", "versionType": "semver", "lessThanOrEqual": "12.0.34"}, {"status": "affected", "version": "12.1.0", "versionType": "semver", "lessThanOrEqual": "12.1.8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n * \n \n URI constructions (for example, for redirects -- this is typical for login pages)\n\n * \n \n Virtual host selection\n\n * \n \n Reverse proxying\n\n * \n \n Misleading logs\n\n * \n \n Etc.\n\n\n\n\n\n\nGiven that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.", "supportingMedia": [{"type": "text/html", "value": "<p>In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the <code>Host</code> header (if present).</p>\n<p>This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).</p>\n<p>This mismatch can cause a number of problems that may be classified as vulnerabilities such as:</p>\n<ul>\n<li>\n \n URI constructions (for example, for redirects -- this is typical for login pages)</li>\n<li>\n \n Virtual host selection</li>\n<li>\n \n Reverse proxying</li>\n<li>\n \n Misleading logs</li>\n<li>\n \n Etc.</li>\n</ul>\n<p>Given that the latest RFCs require that request authority and <code>Host</code> header must match, Jetty should enforce this invariant.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-07-14T08:51:30.527Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6790", "state": "PUBLISHED", "dateUpdated": "2026-07-14T12:20:35.130Z", "dateReserved": "2026-04-21T13:47:52.520Z", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "datePublished": "2026-07-14T08:51:30.527Z", "assignerShortName": "eclipse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Eclipse Jetty", "repo": "https://github.com/jetty/jetty.project", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "9.4.60", "status": "affected", "version": "9.4.0", "versionType": "semver"}, {"lessThanOrEqual": "10.0.28", "status": "affected", "version": "10.0.0", "versionType": "semver"}, {"lessThanOrEqual": "11.0.28", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThanOrEqual": "12.0.34", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "12.1.8", "status": "affected", "version": "12.1.0", "versionType": "semver"}]}], "source": "emo@eclipse.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "matchCriteriaId": "EE3C7B48-2010-4031-8B0A-6895F39250E0", "versionEndExcluding": "9.4.61", "versionStartIncluding": "9.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "matchCriteriaId": "429939D6-D788-4755-B4DF-DEAEDC8973F9", "versionEndExcluding": "10.0.29", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "matchCriteriaId": "474C24C9-B404-4D57-A69D-6F76009C5772", "versionEndExcluding": "11.0.29", "versionStartIncluding": "11.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "matchCriteriaId": "655AA819-8D55-40C7-BCF3-F7D2AC085C41", "versionEndExcluding": "12.0.35", "versionStartIncluding": "12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "matchCriteriaId": "FF2AE57E-99D5-4181-A5B6-77A5FFBEB3F1", "versionEndExcluding": "12.1.9", "versionStartIncluding": "12.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n * \n \n URI constructions (for example, for redirects -- this is typical for login pages)\n\n * \n \n Virtual host selection\n\n * \n \n Reverse proxying\n\n * \n \n Misleading logs\n\n * \n \n Etc.\n\n\n\n\n\n\nGiven that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant."}, {"lang": "es", "value": "En Eclipse Jetty, para solicitudes HTTP/1, HTTP/2 y HTTP/3, no existe una verificaci\u00f3n estricta de que la autoridad de la solicitud (host y puerto) coincida con lo proporcionado en el encabezado Host (si est\u00e1 presente).\n\nEsto no se aplicaba en RFC HTTP anteriores (por ejemplo, en RFC 2616), pero s\u00ed en los RFC m\u00e1s recientes (9110 y 9112).\n\nEsta falta de coincidencia puede causar una serie de problemas que pueden clasificarse como vulnerabilidades, tales como:\n\n * \n \n Construcciones de URI (por ejemplo, para redirecciones -- esto es t\u00edpico en p\u00e1ginas de inicio de sesi\u00f3n)\n\n * \n \n Selecci\u00f3n de host virtual\n\n * \n \n Proxy inverso\n\n * \n \n Registros enga\u00f1osos\n\n * \n \n Etc.\n\nDado que los RFC m\u00e1s recientes requieren que la autoridad de la solicitud y el encabezado Host deben coincidir, Jetty deber\u00eda aplicar este invariante."}], "id": "CVE-2026-6790", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "emo@eclipse.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6790", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T12:18:58.528202Z", "version": "2.0.3"}}]}, "published": "2026-07-14T09:16:41.930", "references": [{"source": "emo@eclipse.org", "tags": ["Vendor Advisory"], "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "emo@eclipse.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.4.0,9.4.60]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.0.28]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0,11.0.28]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.0.34]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.1.0,12.1.8]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Eclipse Jetty", "source": "cna", "vendor": "Eclipse Foundation"}, "product": "jetty", "vendor": "eclipse"}], "created": "2026-07-14T11:00:09.774671+00:00", "updated": "2026-08-01T10:15:03.454423+00:00", "vendors": ["eclipse", "eclipse$PRODUCT$jetty"]}