Improper input validation in Eclipse Jetty

CVE-2026-6790

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying * Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.003 (22.3th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 22.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-6790: held from 0.003 to 0.003.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-6790?
CVE-2026-6790 is a medium-severity vulnerability in Eclipse Jetty, classified under Improper Input Validation. CVSS score: 5.3/10. Published 2026-07-14.
How severe is CVE-2026-6790?
Medium severity. CVSS v3 base score is 5.3 out of 10.