CVE-2026-6790

A flaw was found in Eclipse Jetty. The server does not strictly validate that the request authority (host and port) matches the Host header provided in HTTP/1, HTTP/2, and HTTP/3 requests. This improper validation can lead to various issues, including incorrect handling of URI constructions for redirects, flawed virtual host selection, and problems with reverse proxying. Such discrepancies could potentially be exploited to bypass security mechanisms or misroute network traffic.

Moderate: This flaw in Eclipse Jetty's Host header validation can lead to request routing issues, affecting URI construction for redirects, virtual host selection, and reverse proxying. This could allow an attacker to manipulate how applications process requests, potentially leading to misdirection or bypassing security controls in Red Hat products utilizing Jetty.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.