CVE-2026-18660High· 8.8▾ TwilightIn Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86671High· 8.4In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host a…
CVE-2026-102722Medium· 6.9In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply
CVE-2026-86590Medium· 6.3In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering
CVE-2026-100693High· 8.4Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions
CVE-2026-6790Medium· 5.3Eclipse Jetty: HTTP Authority/Host mismatch
CVE-2026-110726NoneIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header