CVE-2026-18659
Received
Received - Intake
HTTP Method Omission Bypass in Eclipse Jetty
Vulnerability report for CVE-2026-18659, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-15
Last updated on: 2026-10-15
Assigner: Eclipse Foundation
Description
Description
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| eclipse | jetty | From 9.4.0 (inc) to 9.4.64 (inc) |
| eclipse | jetty | From 10.0.0 (inc) to 10.0.32 (inc) |
| eclipse | jetty | From 11.0.0 (inc) to 11.0.32 (inc) |
| eclipse | jetty | From 12.0.0 (inc) to 12.1.11 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
