Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-18662

In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-pattern

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation org.eclipse.jetty.ee11:jetty-ee11-servlet

Default version status: unaffected

  • 12.1.0 to ≤ 12.1.11affected

Eclipse Foundation org.eclipse.jetty.ee10:jetty-ee10-servlet

Default version status: unaffected

  • 12.1.0 to ≤ 12.1.11affected
  • 12.0.0 to ≤ 12.0.38affected

Eclipse Foundation org.eclipse.jetty.ee9:jetty-ee9-security

Default version status: unaffected

  • 12.1.0 to ≤ 12.1.11affected
  • 12.0.0 to ≤ 12.0.38affected

Eclipse Foundation org.eclipse.jetty.ee8:jetty-ee8-security

Default version status: unaffected

  • 12.1.0 to ≤ 12.1.11affected
  • 12.0.0 to ≤ 12.0.38affected

Eclipse Foundation org.eclipse.jetty:jetty-security

Default version status: unaffected

  • 11.0.0 to ≤ 11.0.32affected
  • 10.0.0 to ≤ 10.0.32affected
  • 7.6.13 to ≤ 9.4.64affected

References