Eclipse Jetty: Proxy host blacklist bypass via hostname case variation

Summary

Jetty's servlet forward proxy (ProxyServlet) and CONNECT handler (ConnectHandler) compare requested host names case-sensitively against blacklist entries. Because DNS host names are case-insensitive, a variant such as LOCALHOST:8080 passes a blacklist entry for localhost:8080. An unauthenticated remote attacker can then reach blocked internal HTTP services or TCP endpoints through the proxy (server-side request forgery). Only deployments that use the proxy handlers with host blacklists are affected; a strict whitelist and numeric IP literals are not bypassed by this technique.

Affected

• org.eclipse.jetty:jetty-server 12.1.0 to 12.1.11
• org.eclipse.jetty:jetty-server 12.0.0 to 12.0.38
• org.eclipse.jetty:jetty-proxy 11.0.0 to 11.0.32
• org.eclipse.jetty:jetty-proxy 10.0.0 to 10.0.32
• org.eclipse.jetty:jetty-proxy 9.0.0 to 9.4.64
• Default configurations are unaffected according to the CNA record.

Fixed in

• jetty-server: 12.1.12 and 12.0.39 (open source releases).
• jetty-proxy: the GHSA lists 11.0.33, 10.0.33 and 9.4.65 as patched. Third-party research states that these are commercial HeroDevs releases and that no open source fix exists for the 9.x to 11.x lines. Verify this before relying on these versions.

Workaround

Unknown. No vendor-published workaround was found. Restrict proxy destinations at the network layer (egress firewall or IP allow lists) instead of relying on hostname deny lists.

Exploitation

• CISA SSVC assessment in the CNA record: exploitation 'poc', automatable yes, technical impact partial.
• The GHSA advisory includes a complete proof of concept.
• No confirmed exploitation in the wild was found, and no CISA KEV entry was found.

Our recommendation

• Inventory Java applications and check whether they embed Jetty, especially for proxy functions.
• Upgrade jetty-server to 12.1.12 or 12.0.39 where possible. For jetty-proxy, upgrade to a fixed release for your branch and confirm its origin.
• Stop exposing any Jetty proxy handler to untrusted clients.
• Enforce destination restrictions at the network layer rather than relying on hostname deny lists.
• Patch CVE-2026-18659, CVE-2026-18661 and CVE-2026-18662 together, as they affect the same version ranges.
• Monitor proxy logs for requests to internal destinations.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-7wfj-j486-mxrf github.com
• Eclipse CVE assignment work item 212 gitlab.eclipse.org
• HeroDevs vulnerability directory: CVE-2026-18660 www.herodevs.com
• OSV: CVE-2026-18660 osv.dev
• VulDB: CVE-2026-18660 vuldb.com
• HeroDevs blog: Jetty vulnerabilities CVE-2026-18659 to 18662 www.herodevs.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:34.