CVE-2026-18660 Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames
Attackers can bypass Jetty proxy host blacklists by using case variations in hostnames, potentially enabling Server-Side Request Forgery attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-18660?
CVE-2026-18660 is a high-severity server-side request forgery vulnerability, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
Which versions are affected by CVE-2026-18660?
How do I fix CVE-2026-18660?
Apply the vendor's patch.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-18660 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-18660 exists.
Sources
Also known as DEBIAN-CVE-2026-18660, GHSA-7wfj-j486-mxrf, UBUNTU-CVE-2026-18660.