CVE-2026-77711 Information disclosure in Eclipse Jetty
Jetty HttpClient leaks proxy credentials to the target server when a 407 response is received, exposing sensitive authentication data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77711?
CVE-2026-77711 is a high-severity vulnerability in Eclipse Jetty, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).
The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.
Weakness: CWE-200
Which versions are affected by CVE-2026-77711?
How do I fix CVE-2026-77711?
Apply the vendor's patch.
Is CVE-2026-77711 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77711 exists.
Sources
Also known as DEBIAN-CVE-2026-77711, GHSA-r2c5-3p8g-wpvw, GHSA-vv2w-r86m-5w27, UBUNTU-CVE-2026-77711.