CVE-2026-18659: Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring
Published Oct 15, 2026
·Updated
In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods.
Affected Software
3 affected components
Eclipse Jetty jetty-security
Eclipse Jetty jetty-eeN-security
Eclipse Jetty jetty-eeN-servlet
Event History
Oct 15, 2026
CVE Published
via MITRE·09:44 AM
Data Sourced
via MITRE·09:44 AM
DescriptionWeakness
Frequently Asked Questions
1
What configuration is exposed to this bypass?
Deployments using Jakarta security constraints with http-method-omission are affected. The issue applies to the listed Eclipse Jetty security and servlet components across various versions.
2
What does an attacker need to do to exploit the issue?
An attacker can attempt requests whose HTTP method is a substring of a method defined in an http-method-omission constraint. The vulnerability is described as unauthenticated, so no prior authentication is indicated.