CLEANSTART-2026-PV66574: In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by u...

Q: Which deployments should be prioritized for review?

Prioritize CleanStart Kafka and CleanStart Rundeck deployments that include affected Eclipse Jetty security or servlet packages and use Jakarta security constraints with http-method-omission.

Q: What does an attacker need to exploit this issue?

The issue can be triggered remotely without authentication or user interaction. Exploitation involves sending an HTTP method that is a substring of a method covered by an http-method-omission constraint.

Q: What is the impact of a successful bypass?

A successful bypass can circumvent the intended Jakarta Spec HTTP-method access constraints. The provided severity vector indicates low impact to confidentiality and integrity, with no indicated availability impact.

Published Nov 11, 2026

Updated

CVE-2026-18659 affects multiple packages. In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/kafka<4.3.2-r0

4.3.2-r0

cleanstart/kafka<4.0.2-r6

4.0.2-r6

cleanstart/rundeck<6.1.0-r5

6.1.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.3.2-r0
Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.0.2-r6
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r5

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-18659

Frequently Asked Questions

Which deployments should be prioritized for review?

Prioritize CleanStart Kafka and CleanStart Rundeck deployments that include affected Eclipse Jetty security or servlet packages and use Jakarta security constraints with http-method-omission.

What does an attacker need to exploit this issue?

The issue can be triggered remotely without authentication or user interaction. Exploitation involves sending an HTTP method that is a substring of a method covered by an http-method-omission constraint.

What is the impact of a successful bypass?

A successful bypass can circumvent the intended Jakarta Spec HTTP-method access constraints. The provided severity vector indicates low impact to confidentiality and integrity, with no indicated availability impact.

CLEANSTART-2026-PV66574: In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by u...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for review?

What does an attacker need to exploit this issue?

What is the impact of a successful bypass?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for review?

What does an attacker need to exploit this issue?

What is the impact of a successful bypass?