CLEANSTART-2026-LI30888: In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by u...

Q: What deployments are exposed to this issue?

Deployments using affected Eclipse Jetty security or servlet packages are exposed where Jakarta security constraints rely on http-method-omission. The listed software includes cleanstart/spark-sc213-jdk17-py312 and cleanstart/kafka, but the provided data does not identify which components or configurations within them include affected Jetty packages.

Q: What does an attacker need to do to bypass the constraint?

An attacker must send an HTTP method that is a substring of a method named in the applicable http-method-omission constraint. The provided data does not state whether authentication, network access, or any additional application-specific conditions are required.

Q: How can I determine whether my application is affected?

Review deployed Jetty security and servlet dependencies and inspect Jakarta security configuration for http-method-omission constraints. A configuration may be affected if access control depends on those omissions and requests using substrings of the defined HTTP methods are accepted contrary to the intended constraint.

Published Nov 7, 2026

Updated

CVE-2026-18659 affects multiple packages. In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods. See references for individual vulnerability details.

Affected Software

2 affected componentsFixes available

cleanstart/spark-sc213-jdk17-py312<4.2.0-r8

4.2.0-r8

cleanstart/kafka<4.1.2-r6

4.1.2-r6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/spark-sc213-jdk17-py312 to a version that resolves this vulnerability.
Fixed in 4.2.0-r8
Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.1.2-r6

Event History

Nov 7, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-18659

Frequently Asked Questions

What deployments are exposed to this issue?

Deployments using affected Eclipse Jetty security or servlet packages are exposed where Jakarta security constraints rely on http-method-omission. The listed software includes cleanstart/spark-sc213-jdk17-py312 and cleanstart/kafka, but the provided data does not identify which components or configurations within them include affected Jetty packages.

What does an attacker need to do to bypass the constraint?

An attacker must send an HTTP method that is a substring of a method named in the applicable http-method-omission constraint. The provided data does not state whether authentication, network access, or any additional application-specific conditions are required.

How can I determine whether my application is affected?

Review deployed Jetty security and servlet dependencies and inspect Jakarta security configuration for http-method-omission constraints. A configuration may be affected if access control depends on those omissions and requests using substrings of the defined HTTP methods are accepted contrary to the intended constraint.

CLEANSTART-2026-LI30888: In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by u...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What deployments are exposed to this issue?

What does an attacker need to do to bypass the constraint?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

What deployments are exposed to this issue?

What does an attacker need to do to bypass the constraint?

How can I determine whether my application is affected?