Host Header Authority Mismatch in Eclipse Jetty

Executive Summary

CVE-2026-6790 is a vulnerability in Eclipse Jetty that affects HTTP/1, HTTP/2, and HTTP/3 requests. The issue arises because Jetty does not strictly enforce that the request authority (host and port) matches the value provided in the Host header, if present.

While earlier HTTP RFCs (like RFC 2616) did not require this strict matching, the latest RFCs (9110 and 9112) mandate that the request authority and Host header must align. This mismatch can lead to several problems, including incorrect URI constructions (such as for redirects), virtual host selection errors, reverse proxying issues, and misleading logs.

The vulnerability is classified under CWE-20 (Improper Input Validation) and affects multiple versions of Eclipse Jetty, including 9.4.0 to 9.4.60, 10.0.0 to 10.0.28, 11.0.0 to 11.0.28, 12.0.0 to 12.0.34, and 12.1.0 to 12.1.8.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking if your Eclipse Jetty server processes HTTP requests where the request authority (host and port) does not match the Host header. This can be done through the following methods:

• Review Jetty server logs for discrepancies between the request authority and the Host header. Look for mismatches in hostnames or ports in HTTP/1, HTTP/2, or HTTP/3 requests.
• Use network monitoring tools like Wireshark or tcpdump to capture and analyze HTTP traffic. Filter for HTTP requests and inspect the authority and Host header values for inconsistencies.
• Example tcpdump command to capture HTTP traffic: tcpdump -i any -s 0 -A 'tcp port 80 or tcp port 443' | grep -E 'Host:|:authority:'
• Check the version of Eclipse Jetty running on your system. If it falls within the affected ranges (9.4.0 to 9.4.60, 10.0.0 to 10.0.28, 11.0.0 to 11.0.28, 12.0.0 to 12.0.34, or 12.1.0 to 12.1.8), it may be vulnerable.
• Use vulnerability scanning tools like Nessus, OpenVAS, or OWASP ZAP to scan for CVE-2026-6790. These tools can identify if your Jetty instance is affected.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways, depending on how your system or application uses Eclipse Jetty:

• Incorrect URI constructions: If your application relies on redirects (common in login pages), the mismatch between the request authority and Host header could lead to malformed or unintended redirect URLs, potentially exposing users to phishing attacks or broken functionality.
• Virtual host selection errors: If your server hosts multiple virtual hosts, this vulnerability could cause requests to be routed to the wrong virtual host, leading to unauthorized access to resources or misconfigured responses.
• Reverse proxying issues: If Jetty is used behind a reverse proxy, the mismatch could cause the proxy to misroute requests, leading to service disruptions or exposure of sensitive internal endpoints.
• Misleading logs: The mismatch can result in logs that do not accurately reflect the true origin of requests, making it harder to debug issues or detect malicious activity.
• Security risks: While the CVSS score indicates a low confidentiality impact, the high integrity impact means that attackers could manipulate how requests are processed, potentially leading to unauthorized actions or data tampering.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If the vulnerability leads to incorrect routing of requests or exposure of sensitive data (e.g., through misconfigured redirects or virtual host selection), it could result in unauthorized access to personal data. This may violate GDPR's requirements for data protection and confidentiality, potentially leading to non-compliance and penalties.
• HIPAA (Health Insurance Portability and Accountability Act): For systems handling protected health information (PHI), the vulnerability could lead to improper access controls or misrouting of requests, which may expose PHI to unauthorized parties. This would violate HIPAA's security and privacy rules, risking non-compliance and legal consequences.
• Other standards: The vulnerability may also affect compliance with standards like PCI DSS (Payment Card Industry Data Security Standard) if it impacts systems processing payment card data, as it could lead to improper handling or exposure of sensitive information.

Additionally, the lack of strict input validation (CWE-20) is a common focus in compliance audits, and failing to address this vulnerability could be seen as a failure to implement adequate security controls.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade Eclipse Jetty to the latest patched version as soon as it becomes available. The vendor is expected to release fixes for the affected versions.
• If upgrading is not immediately possible, apply temporary workarounds such as:
• Configure your reverse proxy or load balancer to enforce strict matching between the request authority and the Host header. This can help prevent mismatches from reaching the Jetty server.
• Implement input validation at the application level to ensure the Host header and request authority align before processing requests.
• Monitor and log discrepancies between the request authority and Host header. Use these logs to identify and block malicious or malformed requests.
• Review and update your virtual host configurations to ensure they are not relying on mismatched authority or Host header values.
• Follow the Eclipse Jetty project's security advisories for updates and patches related to CVE-2026-6790.

Useful 0 Not Useful 0