CVE-2026-77711

Overview

Eclipse Jetty is a widely used, embeddable Java web server and servlet container. It supports HTTP/1.1, HTTP/2, HTTP/3, and WebSocket, and is commonly deployed both as a standalone server and embedded within Java application runtimes and frameworks. Its jetty-client module provides HttpClient, Jetty's HTTP client, including support for forward proxies and proxy authentication.

An information exposure vulnerability (CVE-2026-77711) has been identified in the Jetty HttpClient proxy authentication handling, which allows a malicious HTTPS origin server to obtain the proxy credentials configured in a client that reaches it through a forward proxy. The origin answers a request with a forged 407 Proxy Authentication Required challenge, and the client replays the request to the origin with a Proxy-Authorization header.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Eclipse Jetty.

Details

Module Info

• Product: Eclipse Jetty
• Affected packages: org.eclipse.jetty:jetty-client
• Affected versions: >=9.4.0 <=9.4.64, >=10.0.0 <=10.0.32, >=11.0.0 <=11.0.32, >=12.0.0 <=12.0.38, >=12.1.0 <=12.1.12
• GitHub repository: https://github.com/jetty/jetty.project
• Published packages: https://central.sonatype.com/artifact/org.eclipse.jetty/jetty-client
• Package manager: Maven
• Fixed in:
  • OSS Eclipse Jetty 12.0.39, 12.1.13
  • NES for Jetty v9.4.65, v10.0.33, v11.0.33

Vulnerability Info

This High-severity vulnerability is found in the org.eclipse.jetty:jetty-client package in multiple versions of Eclipse Jetty.

When HttpClient sends an HTTPS request through an HTTP forward proxy, it first opens a tunnel with a CONNECT request. Once the proxy accepts the CONNECT, it only forwards bytes, and every later response on that connection is produced by the destination origin inside the TLS tunnel, not by the proxy. ProxyAuthenticationProtocolHandler.accept() does not take this into account. It decides whether a response is a proxy challenge from the status code alone:

@Override
public boolean accept(Request request, Response response)
{
    return response.getStatus() == HttpStatus.PROXY_AUTHENTICATION_REQUIRED_407;
}

A malicious origin can therefore return 407 with a Proxy-Authenticate: Basic header. The handler's getAuthenticationURI() resolves the credential lookup to the configured proxy URI, so the client finds the proxy credentials in its AuthenticationStore. AuthenticationProtocolHandler then applies the result to a copy of the request and sends it on the current connection:

authnResult.apply(newRequest);
// Copy existing, explicitly set, authorization headers.
copyIfAbsent(request, newRequest, HttpHeader.AUTHORIZATION);
copyIfAbsent(request, newRequest, HttpHeader.PROXY_AUTHORIZATION);

AfterAuthenticationListener listener = new AfterAuthenticationListener(authnResult);
Connection connection = (Connection)request.getAttributes().get(Connection.class.getName());
if (connection != null)
    connection.send(newRequest, listener);

After the CONNECT has succeeded, that connection is the TLS connection to the origin. The replayed request carries Proxy-Authorization with the proxy username and password through the tunnel to the origin, which can read them. The proxy itself does not need to be attacker-controlled. With a reusable credential such as Basic authentication, the attacker can then use the proxy as the victim, which may give access to internal destinations reachable only through that proxy.

Mitigation

Only recent versions of Eclipse Jetty are community-supported. Only community-supported versions will receive updates to address this issue. As of January 1, 2026 the Jetty project and Webtide no longer publish Jetty 9, Jetty 10, or Jetty 11 releases to Maven Central; see the project's End-of-Life announcement.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a supported version of Eclipse Jetty (12.0.39 or 12.1.13).
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• 4ra1n (finder)
• pyn3rd (finder)
• unam4 (finder)