CVE-2026-18660: CWE-178
Description
In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
CVSS v4.0
Score 8.8high
Affected software
Eclipse Foundation
Eclipse Foundation
pkg:maven/Eclipse Foundation/org.eclipse.jetty:jetty-serverpkg:maven/Eclipse Foundation/org.eclipse.jetty:jetty-proxyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Eclipse Jetty versions 9.0.0 through 12.1.11 (inclusive), the host whitelist and blacklist mechanisms in the jetty-server and jetty-proxy modules are case-sensitive. This means that a host entry differing only in letter case from a blocked or allowed host can bypass the filtering controls. This behavior is identified as CWE-178 (Improper Neutralization of Input During Case Conversion) and CWE-918 (Server-Side Request Forgery). The vulnerability has a CVSS 4.0 base score of 8.8, indicating high severity. No vendor advisory or patch information is provided in the input data.
Potential Impact
An attacker can bypass host-based access controls by using hostnames that differ only in case from those on the whitelist or blacklist. This could allow unauthorized access or proxying to hosts that should be blocked or restricted, potentially leading to unauthorized resource access or SSRF-related impacts.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be aware of the case sensitivity issue in host filtering and consider additional network-level controls or manual validation to mitigate bypass attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-08-03T13:21:48.912Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad0a18a2cdf04f65621d79d
Added to database: 10/15/2026, 09:48:58 UTC
Last enriched: 10/15/2026, 10:04:46 UTC
Last updated: 10/15/2026, 19:00:27 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.