DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-6790: CVE-2026-6790: Host/Authority Header Desynchronization in Eclipse Jetty

#security #cve #cybersecurity

CVE-2026-6790: Host/Authority Header Desynchronization in Eclipse Jetty

Vulnerability ID: CVE-2026-6790
CVSS Score: 5.3
Published: 2026-07-22

A host/authority desynchronization vulnerability exists in Eclipse Jetty's handling of HTTP/2 and HTTP/3 requests. When both an ':authority' pseudo-header and a standard 'Host' header are present in a request, Jetty fails to validate that they represent the same target host. This desynchronization creates a host-confusion or 'split-brain' state, enabling attackers to bypass access control lists, escape virtual host isolation, poison web caches, or manipulate redirect targets in backend applications.

TL;DR

Eclipse Jetty's HTTP/2 and HTTP/3 pipelines fail to verify that the ':authority' pseudo-header matches the 'Host' header, leading to host-confusion, proxy bypass, and virtual host escapes.

Technical Details

  • CWE ID: CWE-20
  • Attack Vector: Network (AV:N)
  • CVSS Score: 5.3 (Medium)
  • Exploit Status: None (No public exploits)
  • CISA KEV Status: Not Listed
  • Impact: Integrity (Low)
  • Attack Complexity: Low (AC:L)

Affected Systems

  • Eclipse Jetty
  • Eclipse Jetty: >= 9.4.0, < 9.4.61 (Fixed in: 9.4.61)
  • Eclipse Jetty: >= 10.0.0, < 10.0.29 (Fixed in: 10.0.29)
  • Eclipse Jetty: >= 11.0.0, < 11.0.29 (Fixed in: 11.0.29)
  • Eclipse Jetty: >= 12.0.0, < 12.0.35 (Fixed in: 12.0.35)
  • Eclipse Jetty: >= 12.1.0, < 12.1.9 (Fixed in: 12.1.9)

Code Analysis

Commit: 3e5a4da

Fixes #12110 - Request Authority checks needed / PR #14970

Commit: 67ba9e6

Fixes #14840 - Refactor compliance checks

Commit: cbca307

Fixes #14870 - Refactor compliance checks (Backport to 12.0.x)

Mitigation Strategies

  • Upgrade Eclipse Jetty to fixed versions (9.4.61+, 10.0.29+, 11.0.29+, 12.0.35+, or 12.1.9+).
  • Enable HttpCompliance validation checking inside Jetty config and monitor for MISMATCHED_AUTHORITY compliance events.
  • Configure upstream reverse proxies (e.g., NGINX, HAProxy) to validate and align ':authority' pseudo-headers and 'Host' headers, dropping requests with mismatches.

Remediation Steps:

  1. Identify all instances of Jetty running in your environment using discovery scanners or dependency manifests.
  2. Apply the upgrade patch corresponding to your major release train.
  3. Ensure that the default or customized HttpCompliance configurations do not explicitly disable MISMATCHED_AUTHORITY checks.
  4. Deploy a custom compliance event listener in your application bootstrapping class to log and investigate instances where client HTTP requests fail verification.

References

Read the full report for CVE-2026-6790 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)