CVE-2026-6790: Eclipse Jetty: HTTP Authority/Host mismatch
Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty:
- logic based on
HttpURI/Request.getServerName(request)uses:authority - logic based on raw request headers continues to use
Host
This creates a host/authority confusion condition that can break security assumptions in higher layers.
Jetty already performs an explicit authority/Host consistency check on the HTTP/1.1 path, but equivalent validation is missing on the HTTP/2 and HTTP/3 paths.
References
- github.com/advisories/GHSA-7p3p-8qv8-m2vh
- github.com/jetty/jetty.project/commit/3e5a4daec196859b8886b6f67b1157dab47cdb6f
- github.com/jetty/jetty.project/commit/67ba9e6b39661810123680d9c894e99a7940c73d
- github.com/jetty/jetty.project/commit/cbca3076f7c914a232e7a8b22fa95fbf7e67a6cc
- github.com/jetty/jetty.project/issues/14870
- github.com/jetty/jetty.project/pull/14871
- github.com/jetty/jetty.project/pull/14897
- github.com/jetty/jetty.project/pull/14970
- github.com/jetty/jetty.project/releases/tag/jetty-12.0.35
- github.com/jetty/jetty.project/releases/tag/jetty-12.1.9
- github.com/jetty/jetty.project/security/advisories/GHSA-7p3p-8qv8-m2vh
- gitlab.eclipse.org/security/cve-assignment/-/work_items/99
- nvd.nist.gov/vuln/detail/CVE-2026-6790
Code Behaviors & Features
Detect and mitigate CVE-2026-6790 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →