CVE-2026-77711 PUBLISHED

Assigner: eclipse
Reserved: 21.08.2026 Published: 15.10.2026 Updated: 15.10.2026

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).

The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the server, that now has access to the proxy credentials.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.2

Product Status

Vendor Eclipse Foundation
Product Eclipse Jetty
Versions Default: unaffected
  • affected from 12.1.0 to 12.1.12 (incl.)
  • affected from 12.0.0 to 12.0.38 (incl.)
  • affected from 11.0.0 to 11.0.32 (incl.)
  • affected from 10.0.0 to 10.0.32 (incl.)
  • affected from 9.4.0 to 9.4.64 (incl.)

Credits

  • https://github.com/4ra1n finder
  • https://github.com/pyn3rd finder
  • https://github.com/unam4 finder

References

Problem Types

  • CWE-200 CWE