https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 02:16:20 +0000 https://vulnerability.circl.lu/vuln/cve-2026-6790 <p><strong>Affected:</strong> Eclipse Foundation Eclipse Jetty</p> <p>In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).</p> <p>This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).</p> <p>This mismatch can cause a number of problems that may be classified as vulnerabilities such as:</p> <p>* URI constructions (for example, for redirects -- this is typical for login pages)</p> <p>* Virtual host selection</p> <p>* Reverse proxying</p> <p>* Misleading logs</p> <p>* Etc.</p> <p>Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.</p> <p><strong>Affected:</strong> Eclipse Foundation Eclipse Jetty</p> <p>In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).</p> <p>This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).</p> <p>This mismatch can cause a number of problems that may be classified as vulnerabilities such as:</p> <p>* URI constructions (for example, for redirects -- this is typical for login pages)</p> <p>* Virtual host selection</p> <p>* Reverse proxying</p> <p>* Misleading logs</p> <p>* Etc.</p> <p>Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.</p> https://vulnerability.circl.lu/vuln/cve-2026-6790