Improper Validation of Consistency within Input Affecting org.eclipse.jetty:jetty-server package, versions [9.4.0,9.4.61)[10.0.0,10.0.29)[11.0.0,11.0.29)[12.0.0,12.0.35)[12.1.0,12.1.9)

org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine.

Affected versions of this package are vulnerable to Improper Validation of Consistency within Input through ComplianceUtils.verify(HttpURI, HttpFields, HttpCompliance, ComplianceViolation.Listener) in jetty-core/jetty-http/src/main/java/org/eclipse/jetty/http/ComplianceUtils.java. An attacker can bypass host consistency checks by sending a request whose :authority pseudo-header and Host header name different hosts, causing Jetty to accept the request and expose conflicting host identities to different code paths. This lets attacker-controlled host information survive inside the request, so logic that relies on Request.getServerName() or the URI authority can see one host while code reading the raw Host header sees another. In deployments that use host-based routing, ACLs, redirects, or tenant isolation, this can lead to incorrect request handling, host-based access control bypass, and attacker-influenced URL generation or logging.

Notes

• HTTP/1.1 already had its own authority/Host consistency path in HttpConnection/HttpChannelState; the gap was in the HTTP/2 and HTTP/3 server entry flow where the shared compliance check was invoked before that comparison happened.
• The mismatch check only rejects when both values are present and differ after normalizing case and default ports, so requests with only one of :authority or Host present are not part of this issue.

• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub PR
• GitHub PR
• GitHub PR
• GitLab Work Item
• Maintainer's Advisory