CVE-2026-77711

EUVD-2026-101947
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).



The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
eclipseCNA
8.2 HIGH
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.32%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
eclipsejetty
12.1.0 ≤
𝑥
≤ 12.1.12
CNA
eclipsejetty
12.0.0 ≤
𝑥
≤ 12.0.38
CNA
eclipsejetty
11.0.0 ≤
𝑥
≤ 11.0.32
CNA
eclipsejetty
10.0.0 ≤
𝑥
≤ 10.0.32
CNA
eclipsejetty
9.4.0 ≤
𝑥
≤ 9.4.64
CNA
Debian logo
Debian Releases
Debian Product
Codename
jetty12
forky
vulnerable
sid
12.0.40-1
fixed
trixie
vulnerable
trixie (security)
vulnerable
jetty9
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
jetty
jammy
dne
noble
dne
resolute
dne
trusty
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/jetty/jetty.project/security/advisories/GHSA-r2c5-3p8g-wpvw
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/238
https://github.com/jetty/jetty.project/security/advisories/GHSA-r2c5-3p8g-wpvw