CVE-2026-77711
8.2HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-200
Impact
A remote upstream server can steal forward proxy credentials. Any server handling outbound requests from Jetty's HttpClient can trigger this by returning an HTTP 407 status code.
Root cause
Jetty's HttpClient mistakenly treats an HTTP 407 response from the origin server as coming from the forward proxy and exposes the Proxy-Authentication header.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Jetty to the patched release referenced in advisory GHSA-r2c5-3p8g-wpvw once published. As an interim workaround, avoid using HttpClient to route sensitive proxy credentials through untrusted origin endpoints.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.