Skip to content
fr Sign in
8.2 High

CVE-2026-77711 When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy…

Description

When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.

Affected products and versions

Product Affected versions Fixed in
Eclipse Jetty 12.1 12.1.0 → 12.1.12 No fix stated
Eclipse Jetty 12.0 12.0.0 → 12.0.38 No fix stated
Eclipse Jetty 11.0 11.0.0 → 11.0.32 No fix stated
Eclipse Jetty 10.0 10.0.0 → 10.0.32 No fix stated
Eclipse Jetty 9.4 9.4.0 → 9.4.64 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Eclipse Jetty

The 16 CVEs of Eclipse Jetty →
CVE-2026-18661 In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec… 8.8 High CVE-2026-76184 In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to… 8.2 High CVE-2026-76182 In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such… 6.9 Medium CVE-2026-12611 A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually… 8.7 High
Track this CVE