CLEANSTART-2026-YG38126: In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combin...

Q: Which deployments are exposed to this issue?

Deployments using affected Eclipse Jetty security packages are exposed when they define two or more security constraints that have the same http-method-omission set and no url-patterns. The affected package families identified are jetty-security and jetty-eeN-security.

Q: What configuration is required for exploitation?

The issue requires multiple security constraints with identical http-method-omission sets and no url-patterns. The provided data does not establish that a default Jetty configuration includes this pattern.

Q: How can I determine whether my application is affected?

Review the application's configured security constraints for two or more entries that omit the same HTTP methods and do not specify url-patterns. If that configuration exists in an application using the affected Jetty security packages, it matches the condition described for the vulnerability.

Published Nov 7, 2026

Updated

CVE-2026-18662 affects multiple packages. In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. See references for individual vulnerability details.

Affected Software

2 affected componentsFixes available

cleanstart/spark-sc213-jdk17-py312<4.2.0-r8

4.2.0-r8

cleanstart/kafka<4.1.2-r6

4.1.2-r6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/spark-sc213-jdk17-py312 to a version that resolves this vulnerability.
Fixed in 4.2.0-r8
Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.1.2-r6

Event History

Nov 7, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-18662

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using affected Eclipse Jetty security packages are exposed when they define two or more security constraints that have the same http-method-omission set and no url-patterns. The affected package families identified are jetty-security and jetty-eeN-security.

What configuration is required for exploitation?

The issue requires multiple security constraints with identical http-method-omission sets and no url-patterns. The provided data does not establish that a default Jetty configuration includes this pattern.

How can I determine whether my application is affected?

Review the application's configured security constraints for two or more entries that omit the same HTTP methods and do not specify url-patterns. If that configuration exists in an application using the affected Jetty security packages, it matches the condition described for the vulnerability.

CLEANSTART-2026-YG38126: In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combin...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What configuration is required for exploitation?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What configuration is required for exploitation?

How can I determine whether my application is affected?