HTTP Method Omission Bypass in Eclipse Jetty
CVE-2026-18659

6.9MEDIUM

Key Information:

Vendor

Eclipse Foundation

Status
Vendor
CVE Published:
15 October 2026

What is CVE-2026-18659?

Eclipse Jetty has a vulnerability that allows attackers to bypass defined Jakarta Spec constraints related to HTTP methods. This issue arises from the ability to use substrings of standard HTTP methods, potentially allowing unauthorized actions to be performed on applications using affected versions of jetty-security, jetty-eeN-security, and jetty-eeN-servlet. Organizations utilizing Eclipse Jetty should review their implementations and apply appropriate mitigations.

References

https://github.com/jetty/jetty.project/security/advisorie...
https://gitlab.eclipse.org/security/cve-assignment/-/work...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/thientd
.