What is the CVSS score of CVE-2026-6790?

CVE-2026-6790 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-6790?

Yes, a patch is available for CVE-2026-6790. Update the affected software to the latest version immediately.

Eclipse Jetty CVE-2026-6790

EUVD-2026-43646 MEDIUM

Improper Input Validation (CWE-20)

2026-07-14 eclipse

GHSA-7p3p-8qv8-m2vh

Information Disclosure Red Hat Eclipse Jetty Eclipse Foundation

5.3

CVSS 3.1 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable without authentication and no special conditions required; impact limited to partial integrity via redirect or routing manipulation, with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 09:34 vuln.today

CVE Published

Jul 14, 2026 - 08:51 cve.org

MEDIUM 5.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

97 maven packages depend on org.eclipse.jetty:jetty-server (38 direct, 59 indirect)

Ecosystem-wide dependent count for version 9.4.0.v20161208.

DescriptionCVE.org

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).

This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).

This mismatch can cause a number of problems that may be classified as vulnerabilities such as:

URI constructions (for example, for redirects -- this is typical for login pages)

Virtual host selection

Reverse proxying

Misleading logs

Etc.

Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.

AnalysisAI

Eclipse Jetty fails to enforce RFC 9110/9112's requirement that the HTTP request authority (host and port) match the value in the Host header across all supported protocol versions - HTTP/1, HTTP/2, and HTTP/3. Unauthenticated network attackers can exploit this input validation gap to manipulate Host-header-derived URI constructions (particularly redirect targets on login pages), influence virtual host selection, corrupt reverse proxy routing decisions, and produce misleading access logs. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack surface is meaningful in any Jetty deployment that performs host-based routing or generates redirects from the Host header.

Technical ContextAI

Eclipse Jetty is a widely embedded open-source Java HTTP server and servlet container used in enterprise Java frameworks and standalone deployments. The root cause is CWE-20 (Improper Input Validation): Jetty's request processing pipeline across all three supported HTTP versions does not validate that the authority component derived from the request line or HTTP/2/3 pseudo-headers matches the value presented in the Host header. Earlier specifications such as RFC 2616 did not mandate this strict check, making Jetty's historical behavior compliant with older standards, but RFC 9110 (HTTP Semantics) and RFC 9112 (HTTP/1.1) now explicitly require authority-Host header consistency. The CPE cpe:2.3:a:eclipse_foundation:eclipse_jetty:*:*:*:*:*:*:*:* with a wildcard version field indicates all currently tracked Jetty releases are potentially in scope until a patched version is confirmed.

RemediationAI

Monitor the Eclipse Foundation's security tracker at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99 and upgrade to the patched Jetty release once announced; no specific fix version has been confirmed in the available data, so a release version cannot be cited here. As an immediate compensating control, operators running Jetty behind a reverse proxy (nginx, Apache httpd, HAProxy) should configure the proxy to rewrite or strip incoming Host headers and inject a canonical, allowlisted value before forwarding - this prevents a mismatched authority from reaching Jetty's request processing layer. Applications performing redirect generation or virtual host selection should add an explicit server-side allowlist of permitted Host values, rejecting or normalizing requests that present unauthorized host values; note this adds application-layer overhead and must be maintained as hostnames change. Restricting direct external exposure of Jetty ports so all traffic transits a hardening reverse proxy also reduces attack surface while awaiting a vendor patch.