CVE-2026-77711
Received Received - Intake

Jetty HttpClient Proxy Authentication Credential Exposure

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-77711
EUVD
EUVD-2026-101947

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Eclipse Foundation Eclipse Jetty 12.1.0
Eclipse Foundation Eclipse Jetty 12.0.0
Eclipse Foundation Eclipse Jetty 11.0.0
Eclipse Foundation Eclipse Jetty 10.0.0
Eclipse Foundation Eclipse Jetty 9.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Eclipse Jetty's HttpClient when making requests through a forward proxy. If the server responds with a 407 status code (Proxy Authentication Required), the client incorrectly treats it as coming from the proxy and resends the request with the Proxy-Authentication header. This header, containing proxy credentials, is then sent to the server, exposing the credentials.

Detection Guidance

To detect this vulnerability, check if your Jetty HttpClient versions fall within the affected ranges (9.4.0-9.4.64, 10.0.0-10.0.32, 11.0.0-11.0.32, 12.0.0-12.0.38, 12.1.0-12.1.12). Use commands like 'mvn dependency:tree' for Maven projects or 'gradle dependencies' for Gradle projects to inspect dependencies. Monitor network traffic for unexpected Proxy-Authorization headers sent to origin servers.

Impact Analysis

This vulnerability could lead to the exposure of proxy credentials to an unauthorized server. Attackers could intercept these credentials if the server is malicious or compromised, potentially allowing unauthorized access to proxy resources or internal networks.

Compliance Impact

This vulnerability could violate compliance requirements that mandate protection of sensitive credentials and authentication data, such as GDPR (data protection) and HIPAA (health information security). Exposure of credentials may lead to unauthorized access and data breaches, resulting in legal and regulatory penalties.

Mitigation Strategies

Upgrade Eclipse Jetty HttpClient to versions outside the affected range (9.4.65+, 10.0.33+, 11.0.33+, 12.0.39+, or 12.1.13+). If upgrading is not possible, avoid using forward proxies with HttpClient or disable proxy authentication headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77711. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart