CVE-2026-6790: Eclipse Jetty Host Header Vulnerability

CVE-2026-6790 Overview

Eclipse Jetty fails to enforce strict matching between the request authority (host and port) and the Host header for HTTP/1, HTTP/2, and HTTP/3 requests. RFC 9110 and RFC 9112 require this invariant, but Jetty does not validate it. Attackers can exploit this mismatch to manipulate URI construction in redirects, bypass virtual host selection, poison reverse proxy routing, and produce misleading log entries. The flaw is tracked as CWE-20: Improper Input Validation and affects Eclipse Jetty across multiple versions. Login pages that construct redirect URIs from the request authority are particularly exposed to identity redirection attacks.

Critical Impact
Attackers can send requests with mismatched authority and Host header values to influence URI construction, virtual host routing, and reverse proxy decisions in downstream systems.

Affected Products

Eclipse Jetty (HTTP/1 request handling)
Eclipse Jetty (HTTP/2 request handling)
Eclipse Jetty (HTTP/3 request handling)

Discovery Timeline

2026-07-14 - CVE-2026-6790 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-6790

Vulnerability Analysis

Eclipse Jetty processes HTTP requests without validating that the request authority matches the value supplied in the Host header. The request authority is the host and port derived from the request line (HTTP/1) or the :authority pseudo-header (HTTP/2 and HTTP/3). When these two values differ, downstream logic that trusts one field over the other can be manipulated.

Applications commonly construct absolute URIs for redirects using either source. A login page that redirects a user after authentication may build the redirect URL using the Host header while the connection was routed based on the authority. This mismatch enables open redirect conditions, cache poisoning, and virtual host confusion. Log analysis also becomes unreliable because operators cannot determine which host value was authoritative for a given request.

Root Cause

Earlier specifications such as RFC 2616 did not require strict equality between the request authority and the Host header. Jetty followed the older behavior and accepted requests with divergent values. RFC 9110 and RFC 9112 tightened this requirement, but Jetty did not update its parsers to enforce the invariant across HTTP/1, HTTP/2, and HTTP/3.

Attack Vector

An attacker sends a crafted HTTP request over the network with a request authority that differs from the supplied Host header. No authentication or user interaction is required. The vulnerability manifests in URI construction for redirects, virtual host selection, reverse proxy routing decisions, and audit logs. See the Eclipse CVE Assignment Work Item #99 for the vendor description.

Detection Methods for CVE-2026-6790

Indicators of Compromise

HTTP request logs where the request line or :authority pseudo-header contains a host or port that does not match the Host header value.
Unexpected redirect responses pointing to third-party domains originating from Jetty-hosted login or authentication endpoints.
Virtual host access anomalies where requests reach applications not bound to the observed Host header.

Detection Strategies

Instrument reverse proxies or web application firewalls to compare the request-line authority against the Host header and alert on mismatches.
Analyze Jetty access logs for divergent authority and host values by enabling extended log formats that record both fields.
Monitor outbound Location headers returned by Jetty for hostnames that do not correspond to the deployed application domains.

Monitoring Recommendations

Baseline the expected Host header values per virtual host and alert on deviations.
Track redirect chains initiated from authentication endpoints to identify open redirect abuse.
Correlate HTTP/2 :authority pseudo-header values with Host headers for the same connection to surface protocol-level anomalies.

How to Mitigate CVE-2026-6790

Immediate Actions Required

Inventory all Eclipse Jetty deployments and identify versions exposed to untrusted networks.
Deploy or update a reverse proxy in front of Jetty to normalize and validate the Host header before requests reach the application server.
Review application code that consumes Host header values for redirect URI construction and replace with allow-listed hostnames.

Patch Information

Refer to the Eclipse CVE Assignment Work Item #99 for the authoritative list of patched Jetty releases. Upgrade to a fixed version that enforces the RFC 9110 and RFC 9112 requirement for authority and Host header equality.

Workarounds

Terminate HTTP traffic at a proxy that rejects requests with mismatched authority and Host header values.
Configure Jetty virtual hosts with explicit hostname bindings and disable default catch-all handlers.
Harden application logic to construct redirect URIs from server-side configuration rather than request headers.

bash

# Example NGINX rule to enforce Host header matches expected value before proxying to Jetty
server {
    listen 443 ssl http2;
    server_name app.example.com;

    if ($http_host != "app.example.com") {
        return 400;
    }

    location / {
        proxy_set_header Host $host;
        proxy_pass http://jetty_backend;
    }
}