{"id":"CVE-2026-77711","title":"When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).\n\n\n\nThe client mistakenly interprets the 407 as coming from the proxy, so it re-sends the reque…","summary":"When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).\n\n\n\nThe client mistakenly interprets the 407 as coming from the proxy, so it re-sends the reque…","severity":"high","cvss":8.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-200","CWE-201"],"vendor":"Eclipse Foundation","product":"org.eclipse.jetty:jetty-client","affected":["org.eclipse.jetty:jetty-client >= 12.1.0 <= 12.1.12","org.eclipse.jetty:jetty-client >= 12.0.0 <= 12.0.38","org.eclipse.jetty:jetty-client >= 11.0.0 <= 11.0.32","org.eclipse.jetty:jetty-client >= 10.0.0 <= 10.0.32","org.eclipse.jetty:jetty-client >= 9.4.0 <= 9.4.64"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T14:41:34.110","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77711","references":[{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-r2c5-3p8g-wpvw","label":"emo@eclipse.org"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/238","label":"emo@eclipse.org"},{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-r2c5-3p8g-wpvw","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77711.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-77711"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553119"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77711"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77711"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T13:50:25.620133Z"},"cvssSource":"cna","ingestedAt":"2026-10-15T08:58:33.093Z","scores":{"cna":8.2,"vendor":7.5},"epss":0.0044,"epssPercentile":0.38051,"slug":"CVE-2026-77711","body":"## Overview\n\nWhen Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).\n\n\n\nThe client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat Enterprise Linux 7, … · no fix planned: Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77711.json)","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":222361,"id":"CVE-2026-77711","ts":1792073302869,"field":"exploit_available","old":"false","new":"true"}]}