CVE-2026-6790

Name of the Vulnerable Software and Affected Versions Eclipse Jetty (affected versions not specified)

Description For HTTP/1, HTTP/2, and HTTP/3 requests, the software fails to strictly verify that the request authority (comprising the host and port) matches the information provided in the Host header. This lack of enforcement contradicts current RFC 9110 and 9112 standards. This discrepancy can lead to issues involving virtual host selection, reverse proxying, misleading logs, and incorrect URI constructions, such as those used for redirects on login pages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.