CVE-2026-18659

Overview

Eclipse Jetty is a widely used, embeddable Java web server and servlet container. It supports HTTP/1.1, HTTP/2, HTTP/3, and WebSocket, and is commonly deployed both as a standalone server and embedded within Java application runtimes and frameworks. Its jetty-security module provides the authentication and authorization framework, including the ConstraintSecurityHandler that enforces servlet security constraints.

An authorization bypass vulnerability (CVE-2026-18659) has been identified in the ConstraintSecurityHandler of Eclipse Jetty, which allows unauthenticated attackers to bypass security constraints declared with http-method-omission. A request whose HTTP method name is a substring of an omitted method name, such as PATCH against an omitted PROPPATCH, is treated as omitted, so the constraint is not applied and the protected resource is served without authentication.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Eclipse Jetty.

Details

Module Info

• Product: Eclipse Jetty
• Affected packages: org.eclipse.jetty:jetty-security, org.eclipse.jetty.ee8:jetty-ee8-security, org.eclipse.jetty.ee9:jetty-ee9-security, org.eclipse.jetty.ee10:jetty-ee10-servlet, org.eclipse.jetty.ee11:jetty-ee11-servlet
• Affected versions:
  • org.eclipse.jetty:jetty-security: >=7.6.13 <=9.4.64, >=10.0.0 <=10.0.32, >=11.0.0 <=11.0.32
  • org.eclipse.jetty.ee8:jetty-ee8-security: >=12.0.0 <=12.0.38, >=12.1.0 <=12.1.11
  • org.eclipse.jetty.ee9:jetty-ee9-security: >=12.0.0 <=12.0.38, >=12.1.0 <=12.1.11
  • org.eclipse.jetty.ee10:jetty-ee10-servlet: >=12.0.0 <=12.0.38, >=12.1.0 <=12.1.11
  • org.eclipse.jetty.ee11:jetty-ee11-servlet: >=12.1.0 <=12.1.11
• GitHub repository: https://github.com/jetty/jetty.project
• Published packages: https://central.sonatype.com/artifact/org.eclipse.jetty/jetty-security
• Package manager: Maven
• Fixed in:
  • OSS Eclipse Jetty 12.0.39, 12.1.12
  • NES for Jetty v9.4.65, v10.0.33, v11.0.33

Vulnerability Info

This Medium-severity vulnerability is found in the jetty-security package in multiple versions of Eclipse Jetty. In Jetty 12 the same code is shipped in the jetty-ee8-security, jetty-ee9-security, jetty-ee10-servlet and jetty-ee11-servlet packages.

A servlet security constraint can use http-method-omission to protect a URL pattern for every HTTP method except the ones listed. When ConstraintSecurityHandler processes such a mapping, it stores the constraint under a key made of the omitted method names joined with . and followed by the .omission suffix, for example PROPPATCH.omission.

When a request arrives with a method that has no exact constraint mapping, ConstraintSecurityHandler looks for omission constraints that should still apply to it. It decides whether the request method is one of the omitted methods with a plain substring test on that key:

//Get info for constraints that name method omissions where target method name is not omitted
//(ie matches because target method is not omitted, hence considered covered by the constraint)
for (Entry<String, RoleInfo> entry : mappings.entrySet())
{
    if (entry.getKey() != null && entry.getKey().endsWith(OMISSION_SUFFIX) && !entry.getKey().contains(httpMethod))
        applicableConstraints.add(entry.getValue());
}

String.contains is true whenever the request method appears anywhere inside the key, not only when it exactly matches one of the omitted methods. With PROPPATCH omitted, a PATCH request matches PROPPATCH.omission, so the constraint is skipped. The same happens for LOCK when UNLOCK is omitted, and for other pairs such as BIND and UNBIND. The class already has an exact parser for the omitted method set, getOmittedMethods, but this check does not use it.

Once the constraint is skipped, no constraint covers the request. Uncovered HTTP methods are allowed by default because denyUncoveredHttpMethods is false, so an unauthenticated request reaches the protected servlet. Exploitation requires an omission constraint whose omitted methods contain the attacker's method name as a substring, and an endpoint that actually handles that method, such as a REST PATCH handler or a WebDAV servlet.

Mitigation

Only recent versions of Eclipse Jetty are community-supported. Only community-supported versions will receive updates to address this issue. As of January 1, 2026 the Jetty project and Webtide no longer publish Jetty 9, Jetty 10, or Jetty 11 releases to Maven Central; see the project's End-of-Life announcement.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a supported version of Eclipse Jetty (12.0.39, 12.1.12).
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Ta Duc Thien (finder)