CVE-2026-18662: Eclipse Jetty vulnerability
In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec.
Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.
Affected Software
Event History
Frequently Asked Questions
What configurations are affected?
The issue affects Jetty security configurations that define two or more security constraints with the same http-method-omission set and no URL patterns. In that condition, later constraints can override earlier constraints instead of being combined as required by the Jakarta Servlet specification.
What is the practical security impact?
Security constraints defined earlier in the affected configuration may not be enforced when a later constraint has the same HTTP method-omission set and also lacks URL patterns. The exact exposure depends on the constraints that are overridden and the access controls they were intended to apply.
How can I determine whether my deployment is exposed?
Review security-constraint definitions used by jetty-security or jetty-eeN-security. Look for multiple constraints with identical http-method-omission sets and no url-patterns, then verify whether later constraints replace earlier intended protections.