5.3

CVE-2026-6790: eclipse foundation eclipse jetty Improper Input Validation

CVSS: 5.3v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-6790DEBIAN-CVE-2026-6790CGA-2473-57mp-rch6
Published 14-07-2026Last modified 14-07-2026
Open JSON

Vulnerability summary

CVE-2026-6790 is a medium (CVSS 5.3) Improper Input Validation vulnerability in eclipse foundation eclipse jetty. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.5% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.31%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-245X-6QHG-5F4H

Timeline

  1. 14-07-2026
    PublishedVulnerability first disclosed.
  2. 14-07-2026
    Last modifiedVulnerability information updated.

Description

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying * Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.31%

Chance of exploitation in the next 30 days

Percentile

23%

Versus all other CVEs

30-day change

0.00 pp

From 0.31% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.31%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard107 products
  • akhq< 0.27.1-r15
  • apache-activemq-5.19All versions (No fix recorded)
  • apache-activemq-6.1All versions (No fix recorded)
  • apache-activemq-6.2All versions (No fix recorded)
  • apache-activemq-fips-5.19All versions (No fix recorded)
Wolfi29 products
  • akhq< 0.27.1-r15
  • apache-pulsar-4.1All versions (No fix recorded)
  • apache-tika-3.1< 3.1.0-r38
  • apache-tika-3.2< 3.2.3-r18
  • apache-tika-3.2-compat< 3.2.3-r18
Debian2 products
  • jetty12All versions (No fix recorded)
  • jetty9All versions (No fix recorded)
Ubuntu2 products
  • jetty12All versions (No fix recorded)
  • jetty9All versions (No fix recorded)
Eclipse1 product
  • jetty≥ 9.4.0, < 9.4.61 | ≥ 10.0.0, < 10.0.29 | ≥ 11.0.0, < 11.0.29 | ≥ 12.0.0, < 12.0.35 | ≥ 12.1.0, < 12.1.9
Eclipse foundation1 product
  • eclipse jetty≥ 9.4.0, ≤ 9.4.60 | ≥ 10.0.0, ≤ 10.0.28 | ≥ 11.0.0, ≤ 11.0.28 | ≥ 12.0.0, ≤ 12.0.34 | ≥ 12.1.0, ≤ 12.1.8
Org.eclipse.jetty1 product
  • jetty-server≥ 9.4.0.v20161208, ≤ 9.4.58.v20250814 | ≥ 10.0.0, ≤ 10.0.26 | ≥ 11.0.0, ≤ 11.0.26 | ≥ 12.0.0, < 12.0.35 | ≥ 12.1.0, < 12.1.9

7 vendors · 143 products

References

17 links
Show all 17 references