CVE-2026-77711

A flaw was found in Eclipse Jetty's HttpClient. A malicious destination server can cause an information disclosure of proxy authentication credentials when client requests are routed through a forward proxy. By returning a proxy authentication challenge, the server misleads the client into believing the response came from the proxy, causing the client to re-send the request containing sensitive credentials directly to the untrusted server.

This flaw is rated Important because an HTTPS origin reachable through an authenticating forward proxy can forge a 407 response and trick Eclipse Jetty's HttpClient into sending the proxy's Basic credentials through the established TLS tunnel directly to that origin. Exploitation only requires a client configured with forward-proxy authentication connecting to an attacker-controlled or compromised HTTPS destination; the leaked credentials could then be reused against the proxy.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.