CVE-2026-18660
Received Received - Intake

Jetty Host Whitelist Bypass via Case Sensitivity

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-18660
EUVD
EUVD-2026-101987

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
eclipse jetty-server From 9.0.0 (inc) to 9.4.64 (inc)
eclipse jetty-proxy From 9.0.0 (inc) to 9.4.64 (inc)
eclipse jetty-server From 10.0.0 (inc) to 10.0.32 (inc)
eclipse jetty-proxy From 10.0.0 (inc) to 10.0.32 (inc)
eclipse jetty-server From 11.0.0 (inc) to 11.0.32 (inc)
eclipse jetty-proxy From 11.0.0 (inc) to 11.0.32 (inc)
eclipse jetty-server From 12.0.0 (inc) to 12.1.11 (inc)
eclipse jetty-proxy From 12.0.0 (inc) to 12.1.11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Eclipse Jetty involves case-sensitive host whitelist/blacklist matching for DNS hostnames, which are inherently case-insensitive. Attackers can bypass restrictions by altering the case of a hostname while keeping the destination identical. For example, a blacklist entry for 'localhost:8080' would block that exact string but allow 'LOCALHOST:8080,' which resolves to the same host.

Detection Guidance

Check Jetty proxy component versions using commands like 'java -jar start.jar --version' or 'dpkg -l | grep jetty' to identify vulnerable versions (9.0.0-9.4.64, 10.0.0-10.0.32, 11.0.0-11.0.32, 12.0.0-12.1.11). Inspect proxy configuration files for blacklist entries and test with case variations of blocked hosts.

Impact Analysis

This vulnerability allows unauthorized access to blocked internal services or TCP endpoints through Jetty's proxy components. Attackers could exploit it to bypass security controls, access sensitive data, or perform server-side request forgery (SSRF) attacks. The impact includes potential data exposure and compromise of internal systems.

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy). Organizations using affected Jetty versions may fail to meet security controls for data confidentiality and integrity, risking regulatory penalties.

Mitigation Strategies
  • Upgrade Jetty to patched versions: 9.4.65, 10.0.33, 11.0.33, or 12.0.39.
  • Replace case-sensitive blacklists with strict whitelists for hostnames.
  • Disable proxy components if not required.
  • Monitor proxy logs for unusual host variations accessing internal services.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18660. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart