Detections
Analytics

SCA: security update for org.eclipse.jetty:jetty-server (GHSA-7p3p-8qv8-m2vh)

medium Tenable Cloud Security Plugin ID 445142

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request
 authority (host and port) matches what provided in the Host header (if present). This was not enforced in
 earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch
 can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for
 example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying *
 Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must
 match, Jetty should enforce this invariant. (CVE-2026-6790)

Solution

Update the org.eclipse.jetty:jetty-server library and its related packages to version 12.0.35 or later.

See Also

https://github.com/advisories/GHSA-7p3p-8qv8-m2vh

Plugin Details

Severity: Medium

ID: 445142

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 7/23/2026

Updated: 7/23/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-6790

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/22/2026

Vulnerability Publication Date: 7/14/2026

Reference Information

CVE: CVE-2026-6790

cwe: CWE-20