org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to bypass access controls and reach restricted resources. The issue occurs because the server and proxy components perform case-sensitive validation on host allowlists and denylists. By sending requests with altered...

org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to bypass access controls and reach restricted resources. The issue occurs because the server and proxy components perform case-sensitive validation on host allowlists and denylists. By sending requests with altered...

org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to bypass access controls and reach restricted resources. The issue occurs because the server and proxy components perform case-sensitive validation on host allowlists and denylists. By sending requests with altered...

org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to bypass access controls and reach restricted resources. The issue occurs because the server and proxy components perform case-sensitive validation on host allowlists and denylists. By sending requests with altered...

UBUNTU-CVE-2026-18660

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

Linux Distros Unpatched Vulnerability : CVE-2026-18660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that...

org.eclipse.jetty.demos:demo-proxy-webapp (>=10.0.0.beta2, <=10.0.26), org.eclipse.jetty.demos:demos-jetty-embedded (>=10.0.0.beta2, <=10.0.26) +4 more potentially affected by CVE-2026-18660 via org.eclipse.jetty:jetty-proxy (>=10.0.0-alpha0, <=10.0.26)

org.eclipse.jetty:jetty-proxy MAVEN version =10.0.0-alpha0, =10.0.0.beta2, =10.0.0.beta2, =10.0.0-alpha0, =10.0.0-alpha0, =10.0.10, =5.26.1, =5.27.15 Source cves: CVE-2026-18660 Source advisory: SNYK:JAVA-ORGECLIPSEJETTY-21243591...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to improper handling of hostnames in the proxy process. An attacker can bypass access restrictions by supplying hostnames that differ only in letter casing. Remediation Upgrade...

ai.pipestream:pipestream-wiremock-server (>=0.1.1, <=0.1.6), ai.timefold.solver.enterprise:timefold-solver-enterprise-service-test (2.8.0-rc-1) +89 more potentially affected by CVE-2026-18660 via org.eclipse.jetty:jetty-proxy (>=11.0.0-alpha0, <=11.0.26)

org.eclipse.jetty:jetty-proxy MAVEN version =11.0.0-alpha0, =0.1.1, =2.2.0, =1.8.2, =2.2.1, =2.2.1, =2.2.1, =8.0.0, =1.14.4, =0.20.41, =1.32.0, =3.0.0-beta-2, =3.0.0-beta-10 and more Source cves: CVE-2026-18660 Source advisory: SNYK:JAVA-ORGECLIPSEJETTY-21243591...

CVE-2026-18660

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

DEBIAN-CVE-2026-18660

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

CVE-2026-18660

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

CVE-2026-18660 Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

CVE-2026-18660 Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

CVE-2026-18660

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

org.eclipse.jetty.demos:demo-proxy-webapp (>=10.0.0, <=10.0.26), org.eclipse.jetty.demos:demos-jetty-embedded (>=10.0.0, <=10.0.26) +4 more potentially affected by CVE-2026-18660 via org.eclipse.jetty:jetty-proxy (>=10.0.0, <=10.0.26)

org.eclipse.jetty:jetty-proxy MAVEN version =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.10, =5.26.1, =5.27.15 Source cves: CVE-2026-18660 Source advisory: MEND:CVE-2026-18660...

CVE-2026-18660

In Eclipse Jetty , specifically within the jetty-server and jetty-proxy components, a vulnerability exists where the host whitelist/blacklist performs case-sensitive matching . Because DNS hostnames are case-insensitive, an attacker can bypass these security controls by using a hostname that diff...

EUVD-2026-101987

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

CVE-2026-18660

In Eclipse Jetty, across various versions of "jetty-server", and "jetty-proxy", the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

CVE-2026-18660 Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...