Improper Handling of Case Sensitivity in Jetty - CVE-2026-18660

Vulnerability details

The vulnerability allows a remote attacker to bypass destination restrictions and access blocked internal HTTP services or TCP endpoints through the proxy.

The vulnerability exists due to improper handling of case sensitivity in Jetty's ProxyServlet and ConnectHandler when comparing requested DNS hostnames and ports against blacklist entries. A remote attacker can submit an HTTP proxy request or CONNECT request using a case variant of a blacklisted hostname to bypass destination restrictions and access blocked internal HTTP services or TCP endpoints through the proxy.

Blacklist-only configurations are directly affected. This hostname-case technique does not affect numeric IP literals or fixed-target reverse proxies. Destination access remains subject to network reachability and target-side authorization.

Affected software

How to mitigate CVE-2026-18660

External References

• https://github.com/jetty/jetty.project/security/advisories/GHSA-7wfj-j486-mxrf

Related Security Bulletins

• Multiple vulnerabilities in Jetty