CVE-2026-6790: Eclipse Jetty: HTTP Authority/Host mismatch
Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty:
- logic based on
HttpURI/Request.getServerName(request)uses:authority - logic based on raw request headers continues to use
Host
This creates a host/authority confusion condition that can break security assumptions in higher layers.
Jetty already performs an explicit authority/Host consistency check on the HTTP/1.1 path, but equivalent validation is missing on the HTTP/2 and HTTP/3 paths.
References
- github.com/advisories/GHSA-7p3p-8qv8-m2vh
- github.com/jetty/jetty.project/commit/3e5a4daec196859b8886b6f67b1157dab47cdb6f
- github.com/jetty/jetty.project/commit/67ba9e6b39661810123680d9c894e99a7940c73d
- github.com/jetty/jetty.project/commit/cbca3076f7c914a232e7a8b22fa95fbf7e67a6cc
- github.com/jetty/jetty.project/issues/14870
- github.com/jetty/jetty.project/pull/14871
- github.com/jetty/jetty.project/pull/14897
- github.com/jetty/jetty.project/pull/14970
- github.com/jetty/jetty.project/releases/tag/jetty-12.0.35
- github.com/jetty/jetty.project/releases/tag/jetty-12.1.9
- github.com/jetty/jetty.project/security/advisories/GHSA-7p3p-8qv8-m2vh
- gitlab.eclipse.org/security/cve-assignment/-/work_items/99
- nvd.nist.gov/vuln/detail/CVE-2026-6790
Code Behaviors & Features
Detect and mitigate CVE-2026-6790 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →