CVE-2026-18662
Received
Received - Intake
Improper Constraint Combination in Eclipse Jetty
Vulnerability report for CVE-2026-18662, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-15
Last updated on: 2026-10-15
Assigner: Eclipse Foundation
Description
Description
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec.
Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| eclipse | jetty | From 9.4.0 (inc) to 9.4.64 (inc) |
| eclipse | jetty | From 10.0.0 (inc) to 10.0.32 (inc) |
| eclipse | jetty | From 11.0.0 (inc) to 11.0.32 (inc) |
| eclipse | jetty | From 12.0.0 (inc) to 12.0.38 (inc) |
| eclipse | jetty | From 12.1.0 (inc) to 12.1.11 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
