CVE-2026-18661: Eclipse jetty-annotations vulnerability
In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1 url-pattern for a servlet, and had a security-constraint applying to only some of those url-pattern definitions.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Review applications using Eclipse Jetty’s jetty-annotations or jetty-eeN-annotations modules that combine @ServletSecurity annotations with web.xml security constraints for the same URL pattern.
How can I identify a potentially affected servlet configuration?
Inspect web.xml for servlets with more than one url-pattern where a security-constraint applies to only some of those patterns. The issue applies when that servlet also uses a mixed @ServletSecurity annotation and web.xml security-constraint configuration on the same URL pattern.