Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-77711

When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation Eclipse Jetty

Default version status: unaffected

  • 12.1.0 to ≤ 12.1.12affected
  • 12.0.0 to ≤ 12.0.38affected
  • 11.0.0 to ≤ 11.0.32affected
  • 10.0.0 to ≤ 10.0.32affected
  • 9.4.0 to ≤ 9.4.64affected

References