CVE-2026-18660
Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames
Published Oct 15, 2026 · updated Oct 15, 2026 · Eclipse Foundation
In Eclipse Jetty, across various versions of , and , the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
In Eclipse Jetty, across various versions of , and , the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
Oct 15, 2026 · NIST NVD
Updated
In Eclipse Jetty, across various versions of , and , the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
Affected
- vendor Eclipse Foundationversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-18660
In Eclipse Jetty, across various versions of , and , the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-18660
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-18660
30-day exploitation probability 0.4%
first.org - NIST NVDVulnerability recordCVE-2026-18660
In Eclipse Jetty, across various versions of , and , the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
nvd.nist.gov