CVE-2026-18660

Overview

Eclipse Jetty is a widely used, embeddable Java web server and servlet container. It supports HTTP/1.1, HTTP/2, HTTP/3, and WebSocket, and is commonly deployed both as a standalone server and embedded within Java application runtimes and frameworks. Its jetty-proxy module provides forward proxy support, including the ProxyServlet family and the ConnectHandler for HTTP CONNECT tunneling, and lets operators restrict which host:port destinations the proxy may reach through whitelist and blacklist settings.

A server-side request forgery vulnerability (CVE-2026-18660) has been identified in the Eclipse Jetty proxy host whitelist and blacklist, which allows attackers to reach a blacklisted destination by changing the letter case of its hostname. Through ProxyServlet this exposes HTTP responses from the blocked service, and through ConnectHandler it opens a TCP tunnel to the blocked host and port.

Per OWASP: In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like http enabled databases or perform post requests towards internal services which are not intended to be exposed.

This issue affects multiple versions of Eclipse Jetty.

Details

Module Info

• Product: Eclipse Jetty
• Affected packages: org.eclipse.jetty:jetty-proxy, org.eclipse.jetty:jetty-server
• Affected versions:
  • org.eclipse.jetty:jetty-proxy: >=9.0.0 <=9.4.64, >=10.0.0 <=10.0.32, >=11.0.0 <=11.0.32
  • org.eclipse.jetty:jetty-server: >=12.0.0 <=12.0.38, >=12.1.0 <=12.1.11
• GitHub repository: https://github.com/jetty/jetty.project
• Published packages:
  • https://central.sonatype.com/artifact/org.eclipse.jetty/jetty-proxy
  • https://central.sonatype.com/artifact/org.eclipse.jetty/jetty-server
• Package manager: Maven
• Fixed in:
  • OSS Eclipse Jetty 12.0.39, 12.1.12
  • NES for Jetty v9.4.65, v10.0.33, v11.0.33

Vulnerability Info

This High-severity vulnerability is found in the org.eclipse.jetty:jetty-proxy package in multiple versions of Eclipse Jetty (in Jetty 12 the affected ConnectHandler ships in org.eclipse.jetty:jetty-server). Both ConnectHandler and AbstractProxyServlet, the base class of ProxyServlet, keep the configured whitelist and blacklist entries as host:port strings in a plain HashSet and check each destination with a case-sensitive lookup:

public boolean validateDestination(String host, int port)
{
    String hostPort = host + ":" + port;
    if (!whiteList.isEmpty())
    {
        if (!whiteList.contains(hostPort))
        {
            if (LOG.isDebugEnabled())
                LOG.debug("Host {}:{} not whitelisted", host, port);
            return false;
        }
    }
    if (!blackList.isEmpty())
    {
        if (blackList.contains(hostPort))
        {
            if (LOG.isDebugEnabled())
                LOG.debug("Host {}:{} blacklisted", host, port);
            return false;
        }
    }
    return true;
}

Neither the configured entries nor the requested hostname are normalized for case. ProxyServlet.rewriteTarget() passes the request's server name and port to this check before creating the upstream request, and ConnectHandler passes the CONNECT authority before calling connectToServer(). DNS hostnames are case-insensitive (RFC 4343), so a blacklist entry of localhost:8080 rejects that exact spelling but accepts LOCALHOST:8080, which resolves to the same host. A client that can use the proxy can therefore send an HTTP request through ProxyServlet, or open a bidirectional TCP tunnel through ConnectHandler, to a destination the operator blocked. A strict whitelist still rejects an unlisted variant, so deployments that rely on a blacklist alone are directly affected. Numeric IP literals and fixed-target reverse proxies are not bypassed this way, and proxy authentication and network egress controls still apply.

Mitigation

Only recent versions of Eclipse Jetty are community-supported. Only community-supported versions will receive updates to address this issue. As of January 1, 2026 the Jetty project and Webtide no longer publish Jetty 9, Jetty 10, or Jetty 11 releases to Maven Central; see the project's End-of-Life announcement.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a supported version of Eclipse Jetty (12.0.39, 12.1.12).
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• 4ra1n (finder)
• unam4 (finder)