Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-18659

Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation org.eclipse.jetty.ee11:jetty-ee11-servlet

Default version status: unaffected

  • 12.1.0 to ≤ 12.1.11affected

Eclipse Foundation org.eclipse.jetty.ee10:jetty-ee10-servlet

Default version status: unaffected

  • 12.1.0 to ≤ 12.1.11affected
  • 12.0.0 to ≤ 12.0.38affected

Eclipse Foundation org.eclipse.jetty.ee9:jetty-ee9-security

Default version status: unaffected

  • 12.1.0 to ≤ 12.1.11affected
  • 12.0.0 to ≤ 12.0.38affected

Eclipse Foundation org.eclipse.jetty.ee8:jetty-ee8-security

Default version status: unaffected

  • 12.1.0 to ≤ 12.1.11affected
  • 12.0.0 to ≤ 12.0.38affected

Eclipse Foundation org.eclipse.jetty:jetty-security

Default version status: unaffected

  • 11.0.0 to ≤ 11.0.32affected
  • 10.0.0 to ≤ 10.0.32affected
  • 7.6.13 to ≤ 9.4.64affected

References