CVE-2026-6790

Name	CVE-2026-6790
Description	In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying * Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jetty12 (PTS)	trixie, trixie (security)	12.0.17-3.1~deb13u1	vulnerable
	forky, sid	12.0.33-1	vulnerable
jetty9 (PTS)	bullseye	9.4.50-4+deb11u2	vulnerable
	bullseye (security)	9.4.57-0+deb11u3	vulnerable
	bookworm, bookworm (security)	9.4.57-1.1~deb12u1	vulnerable
	trixie, trixie (security)	9.4.57-1.1~deb13u1	vulnerable
	forky, sid	9.4.58-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
jetty12	source	(unstable)	(unfixed)
jetty9	source	(unstable)	(unfixed)

https://github.com/jetty/jetty.project/security/advisories/GHSA-7p3p-8qv8-m2vh