CVE-2026-77711: Infoleak
When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).
The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the server, that now has access to the proxy credentials.
Affected Software
Event History
Frequently Asked Questions
When is an application exposed to this credential leak?
It is exposed when Jetty HttpClient sends a request through a forward proxy and the destination server can return an HTTP 407 response. In that situation, the client may send its Proxy-Authentication header to the destination server.
What must an attacker control to obtain the proxy credentials?
An attacker would need to control, or be able to cause responses from, the server that Jetty HttpClient contacts through the forward proxy. The server can reply with 407 and receive the proxy authentication header when the client retries the request.
How can I determine whether credentials may have been disclosed?
Review Jetty HttpClient traffic and destination-server logs for requests sent through a forward proxy where the server returned HTTP 407. Look for subsequent requests to the destination server containing a Proxy-Authentication header.