CVE-2026-77711

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.

CWE	CWE-200
Vendor	eclipse foundation
Product	eclipse jetty
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse jetty

Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse jetty are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / Eclipse Jetty

12.1.0 ≤ 12.1.12 12.0.0 ≤ 12.0.38 11.0.0 ≤ 11.0.32 10.0.0 ≤ 10.0.32 9.4.0 ≤ 9.4.64

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/jetty/jetty.project/security/advisories/GHSA-r2c5-3p8g-wpvw gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/238

Credits

https://github.com/4ra1n https://github.com/pyn3rd https://github.com/unam4