CVE-2026-18659

Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring

State: Published
Severity: 6.9 Medium
Published: Oct 15, 2026
Updated: Oct 15, 2026
Reserved: Aug 3, 2026

Description

In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	eclipse

Weaknesses

CWE-863

Affected Products

Product	Versions
org.eclipse.jetty.ee11:jetty-ee11-servletEclipse Foundation	12.1.0 through 12.1.11Affected
org.eclipse.jetty.ee10:jetty-ee10-servletEclipse Foundation	12.1.0 through 12.1.11Affected 12.0.0 through 12.0.38Affected
org.eclipse.jetty.ee9:jetty-ee9-securityEclipse Foundation	12.1.0 through 12.1.11Affected 12.0.0 through 12.0.38Affected
org.eclipse.jetty.ee8:jetty-ee8-securityEclipse Foundation	12.1.0 through 12.1.11Affected 12.0.0 through 12.0.38Affected
org.eclipse.jetty:jetty-securityEclipse Foundation	11.0.0 through 11.0.32Affected 10.0.0 through 10.0.32Affected 7.6.13 through 9.4.64Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.