Detections
Analytics

Echo: org.eclipse.jetty:jetty-server: security update to 12.0.35

medium Tenable Cloud Security Plugin ID 463900

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request
 authority (host and port) matches what provided in the Host header (if present). This was not enforced in
 earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch
 can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for
 example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying *
 Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must
 match, Jetty should enforce this invariant. (CVE-2026-6790)

Solution

Update the org.eclipse.jetty:jetty-server library and its related packages to version 12.0.35 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-6790

Plugin Details

Severity: Medium

ID: 463900

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-6790

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 7/14/2026

Reference Information

CVE: CVE-2026-6790