CVE-2026-18660

UNKNOWN 0.0

Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.

CWE	CWE-178 CWE-918
Vendor	eclipse foundation
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation

Be the first to know when new unknown vulnerabilities affecting eclipse foundation are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation /

12.1.0 ≤ 12.1.11 12.0.0 ≤ 12.0.38

Eclipse Foundation /

11.0.0 ≤ 11.0.32 10.0.0 ≤ 10.0.32 9.0.0 ≤ 9.4.64

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/jetty/jetty.project/security/advisories/GHSA-7wfj-j486-mxrf gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/212

Credits

Reported by https://github.com/4ra1n