CLEANSTART-2026-EP54530: In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)
Published Nov 7, 2026
·Updated
Security vulnerability affects the trino package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).
Affected Software
1 affected componentFixes available
cleanstart/trino<484-r0
484-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/trinoto a version that resolves this vulnerability.Fixed in 484-r0
Event History
Nov 7, 2026
Advisory Published
via OSV·12:35 AM
Data Sourced
via OSV·12:35 AM
DescriptionSeverityAffected Software