CLEANSTART-2026-DB63586: In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combin...

Q: Which deployments should be prioritized for review?

Prioritize CleanStart Kafka and Rundeck deployments that include affected Eclipse Jetty security packages, particularly where multiple security constraints use the same http-method-omission set and have no url-patterns.

Q: What configuration condition is required for this issue to occur?

The issue requires two or more security constraints with the same http-method-omission set and no url-patterns. Those constraints are not combined according to the Jakarta Servlet specification.

Q: Can this be detected from the supplied package information alone?

No. The provided data identifies CleanStart Kafka and Rundeck as affected software but does not include package versions or configuration details needed to determine whether a specific deployment has the vulnerable constraint pattern.

Published Nov 11, 2026

Updated

CVE-2026-18662 affects multiple packages. In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/kafka<4.3.2-r0

4.3.2-r0

cleanstart/kafka<4.0.2-r6

4.0.2-r6

cleanstart/rundeck<6.1.0-r5

6.1.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.3.2-r0
Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.0.2-r6
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r5

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-18662

Frequently Asked Questions

Which deployments should be prioritized for review?

Prioritize CleanStart Kafka and Rundeck deployments that include affected Eclipse Jetty security packages, particularly where multiple security constraints use the same http-method-omission set and have no url-patterns.

What configuration condition is required for this issue to occur?

The issue requires two or more security constraints with the same http-method-omission set and no url-patterns. Those constraints are not combined according to the Jakarta Servlet specification.

Can this be detected from the supplied package information alone?

No. The provided data identifies CleanStart Kafka and Rundeck as affected software but does not include package versions or configuration details needed to determine whether a specific deployment has the vulnerable constraint pattern.

CLEANSTART-2026-DB63586: In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combin...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for review?

What configuration condition is required for this issue to occur?

Can this be detected from the supplied package information alone?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for review?

What configuration condition is required for this issue to occur?

Can this be detected from the supplied package information alone?