CVE-2026-77711

State: Published
Severity: 8.2 High
Published: Oct 15, 2026
Updated: Oct 15, 2026
Reserved: Aug 21, 2026

Description

When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).

The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	eclipse

Weaknesses

CWE-200

Affected Products

Product	Versions
Eclipse JettyEclipse Foundation	12.1.0 through 12.1.12Affected 12.0.0 through 12.0.38Affected 11.0.0 through 11.0.32Affected 10.0.0 through 10.0.32Affected 9.4.0 through 9.4.64Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.