In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying * Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request
    authority (host and port) matches what provided in the Host header (if present). This was not enforced in
    earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch
    can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for
    example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying *
    Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must
    match, Jetty should enforce this invariant. (CVE-2026-6790)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request     authority (host and port) matches what provided in the Host header (if present). This was not enforced in     earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch     can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for     example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying *     Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must     match, Jetty should enforce this invariant. (CVE-2026-6790)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
463900	Echo: org.eclipse.jetty:jetty-server: security update to 12.0.35	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463900	Echo: org.eclipse.jetty:jetty-server: security update to 12.0.35	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
445142	SCA: security update for org.eclipse.jetty:jetty-server (GHSA-7p3p-8qv8-m2vh)	Tenable Cloud Security	SCA Checks	Local	medium
445142	SCA: security update for org.eclipse.jetty:jetty-server (GHSA-7p3p-8qv8-m2vh)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
327135	Linux Distros Unpatched Vulnerability : CVE-2026-6790	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-6790

medium

Tenable Plugins

medium

medium

medium

medium

medium