PT-2026-57995 · Eclipse Foundation · Eclipse Jetty

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-6790

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Jetty (affected versions not specified)

Description For HTTP/1, HTTP/2, and HTTP/3 requests, the software fails to strictly verify that the request authority (comprising the host and port) matches the information provided in the Host header. This lack of enforcement contradicts current RFC 9110 and 9112 standards. This discrepancy can lead to issues involving virtual host selection, reverse proxying, misleading logs, and incorrect URI constructions, such as those used for redirects on login pages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-6790

Affected Products

Eclipse Jetty

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-6790 · Security Note
• https://twitter.com/CVEnew/status/2076980586422374750 · Twitter Post
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99 · Note