CVE-2026-18662

Overview

Eclipse Jetty is a widely used, embeddable Java web server and servlet container. It supports HTTP/1.1, HTTP/2, HTTP/3, and WebSocket, and is commonly deployed both as a standalone server and embedded within Java application runtimes and frameworks. Its jetty-security module provides the authentication and authorization framework, including the ConstraintSecurityHandler that enforces the security constraints declared by web applications.

An authorization bypass vulnerability (CVE-2026-18662) has been identified in Jetty's ConstraintSecurityHandler, which allows attackers to reach protected resources with HTTP methods that the application's combined security constraints should deny. When two or more security constraints for the same URL pattern name the same set of omitted HTTP methods, Jetty keeps only the last one processed instead of combining them, so a later permissive constraint can replace an earlier forbidden or role-restricted one.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Eclipse Jetty.

Details

Module Info

• Product: Eclipse Jetty
• Affected packages: org.eclipse.jetty:jetty-security, org.eclipse.jetty.ee8:jetty-ee8-security, org.eclipse.jetty.ee9:jetty-ee9-security, org.eclipse.jetty.ee10:jetty-ee10-servlet, org.eclipse.jetty.ee11:jetty-ee11-servlet
• Affected versions:
  • org.eclipse.jetty:jetty-security: >=7.6.13 <=9.4.64, >=10.0.0 <=10.0.32, >=11.0.0 <=11.0.32
  • org.eclipse.jetty.ee8:jetty-ee8-security: >=12.0.0 <=12.0.38, >=12.1.0 <=12.1.11
  • org.eclipse.jetty.ee9:jetty-ee9-security: >=12.0.0 <=12.0.38, >=12.1.0 <=12.1.11
  • org.eclipse.jetty.ee10:jetty-ee10-servlet: >=12.0.0 <=12.0.38, >=12.1.0 <=12.1.11
  • org.eclipse.jetty.ee11:jetty-ee11-servlet: >=12.1.0 <=12.1.11
• GitHub repository: https://github.com/jetty/jetty.project
• Published packages: https://central.sonatype.com/artifact/org.eclipse.jetty/jetty-security
• Package manager: Maven
• Fixed in:
  • OSS Eclipse Jetty 12.0.39, 12.1.12
  • NES for Jetty v9.4.65, v10.0.33, v11.0.33

Vulnerability Info

This Medium-severity vulnerability is found in the org.eclipse.jetty:jetty-security package in multiple versions of Eclipse Jetty, and in the equivalent jetty-ee8-security, jetty-ee9-security, jetty-ee10-servlet and jetty-ee11-servlet packages of Jetty 12.

The Jakarta Servlet specification requires every security constraint that applies to the same URL pattern and HTTP method to be combined, and an authorization constraint that names no roles overrides the others and denies access. ConstraintSecurityHandler.processConstraintMapping() follows these rules for ordinary mappings, but hands any mapping that declares http-method-omission entries to a separate method and returns early:

if (mapping.getMethodOmissions() != null && mapping.getMethodOmissions().length > 0)
{
    processConstraintMappingWithMethodOmissions(mapping, mappings);
    return;
}

processConstraintMappingWithMethodOmissions() builds a key from the omitted method names (for example GET.omission) and stores a fresh RoleInfo under it, unconditionally replacing whatever was already stored under the same key:

protected void processConstraintMappingWithMethodOmissions(ConstraintMapping mapping, Map<String, RoleInfo> mappings)
{
    String[] omissions = mapping.getMethodOmissions();
    StringBuilder sb = new StringBuilder();
    for (int i = 0; i < omissions.length; i++)
    {
        if (i > 0)
            sb.append(".");
        sb.append(omissions[i]);
    }
    sb.append(OMISSION_SUFFIX);
    RoleInfo ri = new RoleInfo();
    mappings.put(sb.toString(), ri);
    configureRoleInfo(ri, mapping);
}

When an application declares two constraints on the same path that omit the same methods, both apply to every method that is not omitted, but only the one processed last survives. If a forbidden constraint (for example, one omitting GET on /admin/*) is followed by a permissive constraint with the same omission set, a POST to /admin/action is allowed and reaches the protected handler. Reversing the order of the two constraints returns 403. The attacker does not control the order. The flaw is in how Jetty processes the application's static configuration, so any application whose descriptors or programmatic mappings contain such colliding constraints loses the intended authorization check for the non-omitted methods.

Mitigation

Only recent versions of Eclipse Jetty are community-supported. Only community-supported versions will receive updates to address this issue. As of January 1, 2026 the Jetty project and Webtide no longer publish Jetty 9, Jetty 10, or Jetty 11 releases to Maven Central; see the project's End-of-Life announcement.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a supported version of Eclipse Jetty (12.0.39, 12.1.12).
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• 4ra1n (finder)
• unam4 (finder)