CVE-2026-6790: 
Jetty vulnerability analysis and mitigation

CVE-2026-6790 is a Host header validation bypass vulnerability in Eclipse Jetty affecting HTTP/1, HTTP/2, and HTTP/3 request handling. The flaw stems from Jetty's failure to strictly enforce that the request authority (host and port) matches the value provided in the Host header, a requirement introduced in RFC 9110 and RFC 9112. Affected versions include Eclipse Jetty 9.4.0–9.4.60, 10.0.0–10.0.28, 11.0.0–11.0.28, 12.0.0–12.0.34, and 12.1.0–12.1.8. It was published on July 14, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Eclipse Advisory).

The root cause is improper input validation (CWE-20): Jetty does not verify that the request authority derived from the request line or connection context matches the Host header value supplied by the client. This violates the invariant mandated by the latest HTTP RFCs (9110/9112), which earlier standards such as RFC 2616 did not enforce. An unauthenticated, network-accessible attacker can craft HTTP requests where the request authority and Host header deliberately differ, causing Jetty to make incorrect decisions in URI construction (e.g., redirect generation on login pages), virtual host selection, reverse proxy routing, and log recording (Feedly, Eclipse Advisory).

Successful exploitation allows an unauthenticated attacker to perform host header injection attacks, potentially generating malicious redirects (e.g., redirecting users to attacker-controlled sites during login flows), routing requests to unintended virtual hosts, causing reverse proxy misrouting, and poisoning server-side logs with misleading entries. The confidentiality impact is none, but integrity is partially affected as request handling and URI construction can be manipulated. Availability is not impacted, and the scope remains unchanged (Feedly).

1. Reconnaissance: Identify internet-facing Eclipse Jetty instances running vulnerable versions (9.4.0–9.4.60, 10.0.0–10.0.28, 11.0.0–11.0.28, 12.0.0–12.0.34, or 12.1.0–12.1.8) using tools like Shodan or Censys, or by inspecting HTTP response headers (e.g., Server: Jetty).
2. Craft malicious request: Construct an HTTP request where the request-line authority (e.g., in an absolute-form URI or HTTP/2 :authority pseudo-header) differs from the Host header value. For example:

   GET http://attacker.com/login HTTP/1.1
   Host: legitimate-site.com

3. Trigger host header injection: Submit the crafted request to the Jetty server. Because Jetty does not validate the mismatch, it may use the attacker-controlled authority for URI construction (e.g., building redirect URLs) or virtual host selection.
4. Achieve objective: Depending on the application's behavior, the attacker may cause users to be redirected to a malicious domain (open redirect/phishing), route the request to an unintended virtual host (access control bypass), or inject false entries into server logs (log poisoning) (Feedly, Eclipse Advisory).

• Network: HTTP requests where the Host header value does not match the authority in the request-line URI or HTTP/2 :authority pseudo-header; unusual redirect responses pointing to external or unexpected domains.
• Logs: Jetty access logs containing entries where the request URI authority and Host header differ; log entries with unexpected or external hostnames injected into redirect URLs; anomalous virtual host selections in application logs.
• Application Behavior: Users being redirected to unexpected domains during login or authentication flows; requests being served by incorrect virtual hosts; inconsistencies between logged request origins and actual client IPs.

Eclipse Jetty has released patched versions addressing this vulnerability: 9.4.61, 10.0.29, 11.0.29, 12.0.35, and 12.1.9 or later. Organizations should upgrade to the appropriate patched version as the primary remediation (Eclipse Advisory, Feedly). If immediate patching is not feasible, implement strict Host header validation at the reverse proxy or load balancer layer (e.g., nginx, HAProxy) to reject requests where the Host header does not match the expected authority before traffic reaches Jetty.

Coverage has been limited to vulnerability aggregation platforms (VulDB, Tenable Nessus plugin 327135, HeroDevs vulnerability directory) and standard CVE tracking services. No notable researcher commentary or significant social media discussion has been observed beyond routine CVE publication tracking (Feedly).