< Back

CVE-2026-18660

Updated on 15 Oct 2026

Severity

8.8 High severity

Details

CVSS score
8.8
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.

Details

Affected product:
AlmaLinux 9.2 ESU , Apache CXF , Apache Commons , Apache Hadoop , Apache Hive , Apache Kafka , Apache Lucene , Apache Solr , Apache Spark , CometD , Eclipse Jetty , Elasticsearch , Hazelcast , Spring , TuxCare 9.6 ESU , TuxCare 9.8 ESU , activemq , agepredictor , airlift , alluxio , artemis , athenz , avro , aws-sdk-java-v2 , bookkeeper , camel , client_java , console , debezium , druid , geronimo-xbean , gwt , gwtp , hbase , hbase-thirdparty , htmlunit , ignite , incubator-retired-htrace , io.airlift:jmx , io.airlift:jmx-http , java-cas-client , jersey , jgit , metrics , micrometer , micrometer-tracing , mustache.java , pulsar , signalfx-java , tika , tinkerpop , trino , wiremock , zookeeper
Affected packages:
apache-jsp @ 9.4.65 (+15453 more)

Fixes