High 8.8Published Oct 15, 2026

CVE-2026-18660Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames

Updated under an hour ago (2026-10-19 08:23 UTC)

Does this affect you?

It affects Eclipse Foundation org.eclipse.jetty:jetty-server and 1 other product. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.32%, higher than 23% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Eclipse Foundation org.eclipse.jetty:jetty-server

Exploited in the last 30 days

In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.

CVSS: 8.8 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-178, CWE-918
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.32% (percentile 23)
Assigned by: eclipse
NVD analysis: Awaiting Analysis
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Eclipse Foundation org.eclipse.jetty:jetty-server eclipse_foundation:org.eclipse.jetty_jetty_server (from the name)	from 12.1.0 through 12.1.11; from 12.0.0 through 12.0.38	CNA record
Eclipse Foundation org.eclipse.jetty:jetty-proxy eclipse_foundation:org.eclipse.jetty_jetty_proxy (from the name)	from 11.0.0 through 11.0.32; from 10.0.0 through 10.0.32; from 9.0.0 through 9.4.64	CNA record

References

https://github.com/jetty/jetty.project/security/advisories/GHSA-7wfj-j486-mxrf
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/212

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.