Eclipse Jetty Host List Flaw Lets Case Variants Bypass Security Controls

Eclipse Jetty users must address a high-severity vulnerability that allows attackers to bypass host-based security controls. The flaw, tracked as CVE-2026-18660, resides in the `jetty-server` and `jetty-proxy` components. It affects a wide range of versions, including those up to 12.1.11, 12.0.38, 11.0.32, 10.0.32, and 9.4.64. No patch has been confirmed yet in the provided source material.

How it unfolded

• The vulnerability was recorded in the National Vulnerability Database with identifier CVE-2026-18660.
• Security researchers identified that host whitelists and blacklists in affected Jetty versions are case-sensitive.
• This implementation detail allows hosts that differ only by letter case to pass through security filters.

Who is affected

Organizations running Eclipse Jetty versions up to 12.1.11 or 12.0.38 are exposed to this risk. Users of older major versions, specifically those running up to 11.0.32, 10.0.32, or 9.4.64, are also affected. The vulnerability impacts the `jetty-server` and `jetty-proxy` modules. Any system relying on these components for host filtering is potentially vulnerable to bypass techniques that exploit case sensitivity in domain name handling.

Our take on the response

The National Vulnerability Database assigns a CVSS score of 8.8, classifying the severity as High. The weakness involves improper handling of case sensitivity in security lists, categorized under CWE-178 and CWE-918. This rating reflects the ease with which an attacker can craft a request that appears to match a blocked host but differs in case. The lack of a confirmed fix in the source material suggests that immediate mitigation strategies, such as network-level filtering, may be necessary for exposed systems until a vendor update is released.

Who needs to act first

Managed service providers should prioritize systems where Jetty is exposed to untrusted networks. Teams usually begin by identifying all instances of `jetty-server` and `jetty-proxy` running the affected versions. Before applying any changes, it is critical to back up configuration files. Since no patch is confirmed, organizations should consider implementing additional network-level controls to filter traffic. Testing any temporary mitigations in a non-production environment helps prevent service disruptions. Monitor vendor channels closely for official updates.

What to do and how to stay safe: Eclipse Jetty

• Inventory all servers running Eclipse Jetty to identify versions up to 12.1.11, 12.0.38, 11.0.32, 10.0.32, or 9.4.64.
• Review firewall rules to block unauthorized access to Jetty endpoints while awaiting a vendor fix.
• Enable detailed logging on affected systems to detect potential bypass attempts using case variations.
• Monitor official Eclipse Foundation channels for the release of a security update addressing CVE-2026-18660.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-18660?

The National Vulnerability Database rates CVE-2026-18660 with a CVSS score of 8.8, which is classified as High severity.

Which Eclipse Jetty versions are affected by this vulnerability?

Versions up to 12.1.11, 12.0.38, 11.0.32, 10.0.32, and 9.4.64 are affected, specifically in the `jetty-server` and `jetty-proxy` components.

Is there a patch available for this vulnerability?

The source material does not confirm the availability of a patch or fix for CVE-2026-18660.