CVE-2026-18659 PUBLISHED

Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring

Assigner: eclipse
Reserved: 03.08.2026 Published: 15.10.2026 Updated: 15.10.2026

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor Eclipse Foundation
Product
Versions Default: unaffected
  • affected from 12.1.0 to 12.1.11 (incl.)
Vendor Eclipse Foundation
Product
Versions Default: unaffected
  • affected from 12.1.0 to 12.1.11 (incl.)
  • affected from 12.0.0 to 12.0.38 (incl.)
Vendor Eclipse Foundation
Product
Versions Default: unaffected
  • affected from 12.1.0 to 12.1.11 (incl.)
  • affected from 12.0.0 to 12.0.38 (incl.)
Vendor Eclipse Foundation
Product
Versions Default: unaffected
  • affected from 12.1.0 to 12.1.11 (incl.)
  • affected from 12.0.0 to 12.0.38 (incl.)
Vendor Eclipse Foundation
Product
Versions Default: unaffected
  • affected from 11.0.0 to 11.0.32 (incl.)
  • affected from 10.0.0 to 10.0.32 (incl.)
  • affected from 7.6.13 to 9.4.64 (incl.)

Credits

  • https://github.com/thientd finder

References

Problem Types

  • CWE-863 CWE