UpHeron
All vulnerabilities

Servers and applications

CVE-2026-77711

When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.

Severity
High 8.2
Published
15 Oct 2026
Last changed
15 Oct 2026
Added to UpHeron
3 Nov 2026
Sources
CVE Program

Affected software

SoftwareAffected versions
Eclipse JettyServers and applications · cna:eclipse foundation|eclipse jetty
  • From 9.4.0 up to 9.4.64
  • From 10.0.0 up to 10.0.32
  • From 11.0.0 up to 11.0.32
  • From 12.0.0 up to 12.0.38
  • From 12.1.0 up to 12.1.12

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-77711