CVE-2026-18660 in Jetty
Summary
by MITRE • 10/15/2026
In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability in question resides within the access control mechanisms of the Eclipse Jetty web server and its associated proxy components, specifically affecting versions of jetty-server and jetty-proxy. This security flaw stems from a fundamental logic error in how host-based filtering rules are evaluated against incoming HTTP requests. In many enterprise environments, it is standard practice to implement strict allowlists or denylists for hosts based on their domain names or IP addresses to prevent unauthorized access, cross-site request forgery attacks, or header injection attempts. The intended behavior of these filters is to match the hostname provided in the Host header against a predefined set of permitted or blocked values with exact precision, ensuring that only explicitly authorized entities can interact with the service.
The technical flaw arises because the comparison logic used for validating hostnames against the configured whitelist or blacklist is case-sensitive by default, despite the fact that domain name resolution and HTTP specifications treat hostnames as case-insensitive according to RFC 3986 and related standards. This discrepancy creates a significant bypass vector where an attacker can manipulate the Host header of an HTTP request to include uppercase characters in positions that differ from the configured filter rules. For instance, if a server is configured with a whitelist containing only example.com, a request bearing the Host header Example.COM or EXAMPLE.COM would technically pass through the validation logic because string equality checks distinguish between 'e' and 'E'. This oversight allows traffic to bypass security controls that were designed to restrict access based on domain identity.
The operational impact of this vulnerability is substantial for organizations relying on Jetty as their primary HTTP server or reverse proxy, particularly in scenarios where host-based filtering is the sole line of defense against unauthorized endpoints. Attackers can exploit this case-sensitivity gap to bypass IP allowlists that rely on hostname resolution, evade Content Security Policy restrictions tied to specific domains, and potentially access administrative interfaces or sensitive API endpoints that were intended to be restricted. In a reverse proxy configuration, this could lead to the routing of malicious traffic to backend services that are not supposed to receive external requests from certain sources, thereby compromising the integrity of the application architecture and exposing internal resources to potential exploitation by unauthorized users.
This issue aligns with CWE-20 Improper Input Validation, as the system fails to normalize input before performing security-critical comparisons, and it also relates to CWE-697 Incorrect Comparison, where the comparison logic does not account for case-insensitivity inherent in domain name systems. From a threat modeling perspective using MITRE ATT&CK, this vulnerability facilitates techniques associated with Initial Access or Defense Evasion, specifically allowing adversaries to bypass access control mechanisms through input manipulation. The lack of canonicalization means that security policies are effectively weakened by trivial variations in character casing, which is a common oversight in software development when dealing with network identifiers.
To mitigate this risk, developers and system administrators must ensure that all host validation logic within Jetty configurations performs case-insensitive comparisons. This can be achieved by normalizing the Host header value to lowercase before comparing it against the whitelist or blacklist entries. For users of affected versions, upgrading to a patched release where this normalization is implemented in the core server code is the most effective remediation strategy. In environments where an immediate upgrade is not feasible, implementing a reverse proxy layer such as Nginx or Apache HTTP Server in front of Jetty can provide an additional control plane; these proxies typically handle hostname canonicalization correctly and can enforce strict case-insensitive matching before forwarding requests to the backend Jetty instances, thereby closing the bypass vector.