CVE-2026-6790

{"id": "CVE-2026-6790", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6790", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T12:18:58.528202Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"repo": "https://github.com/jetty/jetty.project", "vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "versions": [{"status": "affected", "version": "9.4.0", "versionType": "semver", "lessThanOrEqual": "9.4.60"}, {"status": "affected", "version": "10.0.0", "versionType": "semver", "lessThanOrEqual": "10.0.28"}, {"status": "affected", "version": "11.0.0", "versionType": "semver", "lessThanOrEqual": "11.0.28"}, {"status": "affected", "version": "12.0.0", "versionType": "semver", "lessThanOrEqual": "12.0.34"}, {"status": "affected", "version": "12.1.0", "versionType": "semver", "lessThanOrEqual": "12.1.8"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T09:16:41.930", "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99", "tags": ["Vendor Advisory"], "source": "emo@eclipse.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n * \n \n URI constructions (for example, for redirects -- this is typical for login pages)\n\n * \n \n Virtual host selection\n\n * \n \n Reverse proxying\n\n * \n \n Misleading logs\n\n * \n \n Etc.\n\n\n\n\n\n\nGiven that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant."}, {"lang": "es", "value": "En Eclipse Jetty, para solicitudes HTTP/1, HTTP/2 y HTTP/3, no existe una verificaci\u00f3n estricta de que la autoridad de la solicitud (host y puerto) coincida con lo proporcionado en el encabezado Host (si est\u00e1 presente).\n\nEsto no se aplicaba en RFC HTTP anteriores (por ejemplo, en RFC 2616), pero s\u00ed en los RFC m\u00e1s recientes (9110 y 9112).\n\nEsta falta de coincidencia puede causar una serie de problemas que pueden clasificarse como vulnerabilidades, tales como:\n\n * \n \n Construcciones de URI (por ejemplo, para redirecciones -- esto es t\u00edpico en p\u00e1ginas de inicio de sesi\u00f3n)\n\n * \n \n Selecci\u00f3n de host virtual\n\n * \n \n Proxy inverso\n\n * \n \n Registros enga\u00f1osos\n\n * \n \n Etc.\n\nDado que los RFC m\u00e1s recientes requieren que la autoridad de la solicitud y el encabezado Host deben coincidir, Jetty deber\u00eda aplicar este invariante."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE3C7B48-2010-4031-8B0A-6895F39250E0", "versionEndExcluding": "9.4.61", "versionStartIncluding": "9.4.0"}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "429939D6-D788-4755-B4DF-DEAEDC8973F9", "versionEndExcluding": "10.0.29", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "474C24C9-B404-4D57-A69D-6F76009C5772", "versionEndExcluding": "11.0.29", "versionStartIncluding": "11.0.0"}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "655AA819-8D55-40C7-BCF3-F7D2AC085C41", "versionEndExcluding": "12.0.35", "versionStartIncluding": "12.0.0"}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF2AE57E-99D5-4181-A5B6-77A5FFBEB3F1", "versionEndExcluding": "12.1.9", "versionStartIncluding": "12.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}