CVE-2026-6790 identifies a vulnerability in Eclipse Jetty where the server does not strictly verify that the request authority (host and port) matches the Host header in HTTP/1, HTTP/2, and HTTP/3 requests. While earlier HTTP RFCs did not mandate this check, the latest RFCs (9110 and 9112) require it. This discrepancy can cause various issues including incorrect URI construction (notably for redirects), improper virtual host selection, reverse proxying errors, and misleading logging. The vulnerability is categorized under CWE-20 (Improper Input Validation). Multiple versions of Eclipse Jetty are affected, but no official patch or remediation level has been provided as of the published date.

The vulnerability does not directly impact confidentiality or availability but can lead to integrity issues such as incorrect URI redirects, misrouting due to virtual host selection errors, and misleading logs. These issues may affect application behavior and security controls relying on accurate host information. The CVSS score of 5.3 (medium severity) reflects limited impact with no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided, users should monitor Eclipse Foundation advisories for updates. Until a fix is available, consider reviewing application logic that depends on host header validation and implement additional checks where feasible to ensure host header and request authority consistency.