Information disclosure in Jetty - CVE-2026-77711
Published: October 15, 2026
Vulnerability identifier: #VU155898
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-77711
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose proxy authentication credentials.
The vulnerability exists due to improper validation of the source of proxy authentication challenges in Jetty HttpClient's ProxyAuthenticationProtocolHandler when processing origin responses inside an established HTTPS CONNECT tunnel. A remote attacker can return a crafted 407 response with a Proxy-Authenticate: Basic header from a controlled HTTPS origin to disclose proxy authentication credentials.
Exploitation requires the client to have matching challenge-based proxy credentials configured. The proxy itself does not need to be controlled by the attacker, and disabling certificate validation is not required.
Affected software
Jetty
How to mitigate CVE-2026-77711
Install security update from vendor's website.
Jetty - addressed in versions 9.4.65, 10.0.33, 12.0.39, 12.1.13