Case-Sensitive Host Whitelist Vulnerability in Eclipse Jetty Server and Proxy
CVE-2026-18660

8.8HIGH

Key Information:

Vendor

Eclipse Foundation

Status
Vendor
CVE Published:
15 October 2026

What is CVE-2026-18660?

Eclipse Jetty's jetty-server and jetty-proxy components exhibit a case sensitivity flaw in their host whitelist and blacklist configurations. This vulnerability allows malicious actors to exploit hosts that vary only by case, potentially leading to unauthorized access or data breach. Organizations using affected versions are encouraged to review their configurations and implement necessary mitigations to prevent exploitation. For more detailed insights and recommendations, refer to the security advisories provided by the Eclipse Foundation.

References

https://github.com/jetty/jetty.project/security/advisorie...
https://gitlab.eclipse.org/security/cve-assignment/-/work...

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Reported by https://github.com/4ra1n
.