Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-18660

Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation org.eclipse.jetty:jetty-server

Default version status: unaffected

  • 12.1.0 to ≤ 12.1.11affected
  • 12.0.0 to ≤ 12.0.38affected

Eclipse Foundation org.eclipse.jetty:jetty-proxy

Default version status: unaffected

  • 11.0.0 to ≤ 11.0.32affected
  • 10.0.0 to ≤ 10.0.32affected
  • 9.0.0 to ≤ 9.4.64affected

References