MajorCritical vulnerability

CVE-2026-18660 (CVSS 8.8)

NVD · officialPublished Oct 15, 2026Risk 37/100EPSS 0.4%

In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.

Technical details

CVSS

8.8

AV:NetworkAC:LowPR:NoneUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source