CLEANSTART-2026-RK48118: In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case

Q: When should this be treated as exploitable in a deployment?

Treat it as exploitable when Jetty server or proxy host allowlist or denylist rules are used as a security boundary. A host value that differs from a configured entry only by letter case may bypass the intended policy.

Published Nov 7, 2026

Updated

Security vulnerability affects the kafka package. In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.

Affected Software

1 affected componentFixes available

cleanstart/kafka<4.1.2-r6

4.1.2-r6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.1.2-r6

Event History

Nov 7, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-18660

Frequently Asked Questions

When should this be treated as exploitable in a deployment?

Treat it as exploitable when Jetty server or proxy host allowlist or denylist rules are used as a security boundary. A host value that differs from a configured entry only by letter case may bypass the intended policy.

CLEANSTART-2026-RK48118: In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

When should this be treated as exploitable in a deployment?

Company

Resources

Contact

Frequently Asked Questions

When should this be treated as exploitable in a deployment?