CLEANSTART-2026-JX34186: In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case
Security vulnerability affects the strimzi-kafka-operator package. In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/strimzi-kafka-operatorto a version that resolves this vulnerability.Fixed in 1.3.0-r0
Event History
Frequently Asked Questions
What configurations are exposed to this issue?
Deployments are exposed if they use Eclipse Jetty host allowlists or blocklists and rely on those rules to enforce hostname restrictions. A hostname that differs from a configured entry only by letter case may be handled incorrectly.
What does an attacker need to exploit it?
An attacker needs network access to the affected Jetty service and must be able to send a request using a host value whose casing differs from a hostname covered by the configured whitelist or blacklist. No authentication or user interaction is required according to the supplied severity vector.
Are default deployments affected?
The provided data identifies the case-sensitive host whitelist/blacklist behavior, but does not state whether the affected Strimzi Kafka Operator package enables or configures host filtering by default. Assess deployments that have explicitly configured Jetty host allowlist or blocklist rules.
What can be done before a fix is available?
Avoid relying solely on case-sensitive Jetty host allowlist or blocklist matching. Normalize hostnames to a consistent case before applying policy, and enforce equivalent hostname restrictions in an upstream proxy, load balancer, or network control where possible.