Eclipse Jetty does not enforce that the request authority (host and port) matches the Host header when processing HTTP/1, HTTP/2, or HTTP/3 requests. Because this invariant, mandated by RFC 9110 and RFC 9112, is omitted, an attacker can send a request whose authority component differs from the Host header. The mismatch can cause a number of problems such as incorrect virtual host selection, unintended redirects in URI construction, reverse‑proxy misrouting, or misleading log entries, as described in the CVE.

The affected product is Eclipse Jetty from the Eclipse Foundation. Any Jetty deployment that handles HTTP/1.x, HTTP/2, or HTTP/3 requests without strict Host header validation is vulnerable. The vulnerability applies to all versions of Jetty until the public fix is applied; specific version ranges are not listed in the available data.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation currently, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted HTTP request sent over the network by an adversary. When exploited, the flaw could affect applications that rely on host header–based routing, virtual hosting, or reverse proxy functionality.