Jetty's proxy host whitelist and blacklist treat DNS hostnames with case-sensitive matching, while DNS names are case-insensitive. This mismatch allows an attacker to craft hostnames that differ only by letter case from blocked entries, causing the proxy to forward traffic to disallowed destinations. Such a bypass can expose internal services, leak confidential data, and potentially enable further lateral movement within the target network.

The flaw is present across multiple releases of Eclipse Jetty's jetty-server and jetty-proxy components. Specific version ranges are not listed in the advisory, so all versions referenced by the advisory should be considered vulnerable until a corrected release is applied.

The vendor assigns a CVSS score of 8.8, indicating high severity, while the EPSS score is reported as less than 1%, suggesting a low probability of active exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog, and no public exploits are known. The likely attack vector is a network-based request to the Jetty proxy, where the attacker supplies a host header or destination URL that matches a blocked hostname only in letter case, thereby bypassing the intended filter. If the proxy is publicly reachable and the attacker can control the destination hostname, the confidentiality and availability of internal resources are at risk.