PT-2026-114849 · Eclipse Foundation · Eclipse Jetty
CVE-2026-77711
·
Published
2026-10-15
·
Updated
2026-10-15
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
When Jetty's
HttpClient make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the
Proxy-Authentication header, which arrives to the server, that now has access to the proxy credentials.Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Eclipse Jetty