CVE-2026-77711: CWE-200 in Eclipse Foundation Eclipse Jetty
Description
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.
CVSS v4.0
Score 8.2high
Affected software
Eclipse Foundation
Eclipse Jetty
pkg:maven/org.eclipse.jetty/jetty-clientRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Eclipse Jetty's HttpClient mishandles HTTP 407 responses when communicating through a forward proxy. Specifically, if the server returns a 407 status code, the client mistakenly assumes it is from the proxy and resends the request with the Proxy-Authentication header. This results in proxy credentials being sent to the server, leading to unintended information disclosure (CWE-200). The vulnerability affects multiple Jetty versions from 9.4.0 through 12.1.12 as specified.
Potential Impact
The vulnerability allows a server to obtain proxy authentication credentials that should only be sent to the proxy. This can lead to unauthorized disclosure of sensitive proxy credentials, potentially compromising proxy access and related network security.
Mitigation Recommendations
No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using vulnerable Jetty versions with forward proxies or consider alternative HTTP clients that correctly handle 407 responses.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-08-21T08:58:54.421Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad097062cdf04f6561d2787
Added to database: 10/15/2026, 09:04:06 UTC
Last enriched: 10/15/2026, 09:18:16 UTC
Last updated: 10/15/2026, 19:00:27 UTC
Views: 25
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.