CVE-2026-18659
Awaiting Analysis Awaiting Analysis - Queue

HTTP Method Omission Bypass in Eclipse Jetty

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-18659
EUVD
EUVD-2026-101996

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
eclipse jetty From 9.4.0 (inc) to 9.4.64 (inc)
eclipse jetty From 10.0.0 (inc) to 10.0.32 (inc)
eclipse jetty From 11.0.0 (inc) to 11.0.32 (inc)
eclipse jetty From 12.0.0 (inc) to 12.1.11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Eclipse Jetty allows attackers to bypass security constraints by using substrings of defined HTTP methods in http-method-omission settings. For example, if PROPPATCH is omitted, an attacker could use PATCH to bypass authentication. The issue occurs because Jetty checks for substrings instead of exact matches.

Detection Guidance

To detect this vulnerability, check if your Jetty server uses versions 9.4.0 to 9.4.64, 10.0.0 to 10.0.32, 11.0.0 to 11.0.32, or 12.0.0 to 12.1.11. Review the ConstraintSecurityHandler configuration for http-method-omission constraints. Test for bypass by sending requests with HTTP methods that are substrings of omitted methods (e.g., PATCH if PROPPATCH is omitted).

Commands to check Jetty version: grep -r 'jetty.version' /path/to/jetty or check the server startup logs. Inspect web.xml or security constraints for http-method-omission entries.

Impact Analysis

An attacker could gain unauthorized access to protected resources by exploiting this flaw. They only need unauthenticated access to send requests with substring HTTP methods. This could lead to data breaches, unauthorized modifications, or other security violations depending on the application's use case.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable Jetty versions may fail compliance audits if they cannot demonstrate proper security controls to prevent such bypasses.

Mitigation Strategies

Upgrade Jetty to a patched version where the substring test is replaced with the exact-set parser method getOmittedMethods(). If upgrading is not immediately possible, review and modify http-method-omission constraints to avoid substring overlaps. Disable or restrict access to affected endpoints until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18659. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart