CVE-2026-18659: Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring
In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jetty12to a version that resolves this vulnerability.Fixed in 12.0.39-1 - Upgrade
Upgrade
debian/jetty12to a version that resolves this vulnerability.Fixed in 12.0.40-2
Event History
Frequently Asked Questions
What configuration is exposed to this bypass?
Deployments using Jakarta security constraints with http-method-omission are affected. The issue applies to the listed Eclipse Jetty security and servlet components across various versions.
What does an attacker need to do to exploit the issue?
An attacker can attempt requests whose HTTP method is a substring of a method defined in an http-method-omission constraint. The vulnerability is described as unauthenticated, so no prior authentication is indicated.