Two vulnerabilities have been identified in Eclipse Jetty affecting request processing across different HTTP protocols. The first vulnerability allows HTTP request trailers received on one HTTP/1.1 keep-alive connection to persist and be incorrectly associated with subsequent requests because trailer metadata is not cleared between requests, potentially causing stale data to influence application logic. The second vulnerability affects HTTP/2 and HTTP/3 by failing to validate consistency between the: authority pseudo-header and the Host header, allowing a single request to present conflicting host identities that may undermine host-based access controls, virtual host isolation, routing, and auditing mechanisms. Together, these flaws can result in incorrect request handling and policy bypasses in applications relying on trailer or host information for sensitive decisions.
CVE-2026-10051 (CVSS 6.9 — Medium): A cross-request leakage vulnerability has been identified in Jetty's HTTP/1.1 keep-alive connections with trailers. An attacker can exploit this by sending a request with trailers that are then stamped onto subsequent requests, potentially leading to incorrect behavior and security-sensitive logic branching.[/subscribe_to_unlock_form]
Two vulnerabilities have been identified in Eclipse Jetty affecting request processing across different HTTP protocols. The first vulnerability allows HTTP request trailers received on one HTTP/1.1 keep-alive connection to persist and be incorrectly associated with subsequent requests because trailer metadata is not cleared between requests, potentially causing stale data to influence application logic. The second vulnerability affects HTTP/2 and HTTP/3 by failing to validate consistency between the: authority pseudo-header and the Host header, allowing a single request to present conflicting host identities that may undermine host-based access controls, virtual host isolation, routing, and auditing mechanisms. Together, these flaws can result in incorrect request handling and policy bypasses in applications relying on trailer or host information for sensitive decisions.
CVE-2026-10051 (CVSS 6.9 — Medium): A cross-request leakage vulnerability has been identified in Jetty's HTTP/1.1 keep-alive connections with trailers. An attacker can exploit this by sending a request with trailers that are then stamped onto subsequent requests, potentially leading to incorrect behavior and security-sensitive logic branching.[emaillocker id="1283"]
CVE-2026-6790 (CVSS 5.3 — Medium): A vulnerability has been identified in Jetty's handling of HTTP Authority/Host mismatch on HTTP/2 and HTTP/3 paths. This can lead to host/authority confusion, breaking security assumptions in higher layers and potentially allowing attackers to bypass host-based ACLs, cause virtual host or tenant isolation failures, and more.
The following reports contain further technical details:
[/emaillocker]