CVE-2026-18660: Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames
In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Eclipse Jetty Server or Eclipse Jetty Proxy that rely on host allowlists or blocklists to constrain proxy destinations are exposed if those controls compare hostnames case-sensitively.
What does an attacker need to exploit it?
An attacker needs a way to cause the affected proxy functionality to evaluate a destination hostname. They can use a hostname whose letter casing differs from an entry in the configured whitelist or blacklist.
Are default deployments affected?
The provided information identifies the issue in configured host whitelist/blacklist handling. It does not establish that a default configuration enables or relies on these controls.
What can be done while patching is unavailable?
Do not rely solely on Jetty host whitelist or blacklist matching to enforce hostname-based proxy restrictions. Apply equivalent destination restrictions in a control that normalizes DNS hostname case before comparison.