---
id: CVE-2026-77711
title: >-
  When Jetty's `HttpClient` make a request to a server through a forward proxy,
  the server may reply with a 407 (Proxy Authentication Required).




  The client mistakenly interprets the 407 as coming from the proxy, so it
  re-sends the reque…
summary: >-
  When Jetty's `HttpClient` make a request to a server through a forward proxy,
  the server may reply with a 407 (Proxy Authentication Required).




  The client mistakenly interprets the 407 as coming from the proxy, so it
  re-sends the reque…
severity: high
cvss: 8.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-200
  - CWE-201
vendor: Eclipse Foundation
product: 'org.eclipse.jetty:jetty-client'
affected:
  - 'org.eclipse.jetty:jetty-client >= 12.1.0 <= 12.1.12'
  - 'org.eclipse.jetty:jetty-client >= 12.0.0 <= 12.0.38'
  - 'org.eclipse.jetty:jetty-client >= 11.0.0 <= 11.0.32'
  - 'org.eclipse.jetty:jetty-client >= 10.0.0 <= 10.0.32'
  - 'org.eclipse.jetty:jetty-client >= 9.4.0 <= 9.4.64'
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T14:41:34.110'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77711'
references:
  - url: >-
      https://github.com/jetty/jetty.project/security/advisories/GHSA-r2c5-3p8g-wpvw
    label: emo@eclipse.org
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/238'
    label: emo@eclipse.org
  - url: >-
      https://github.com/jetty/jetty.project/security/advisories/GHSA-r2c5-3p8g-wpvw
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77711.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-77711'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2553119'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-77711'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77711'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T13:50:25.620133Z'
cvssSource: cna
ingestedAt: '2026-10-15T08:58:33.093Z'
scores:
  cna: 8.2
  vendor: 7.5
epss: 0.0044
epssPercentile: 0.38379
---

## Overview

When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).



The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat Enterprise Linux 7, … · no fix planned: Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77711.json)