Security Flaw in Eclipse Jetty's Handling of Servlet Security Annotations
CVE-2026-18661

8.8HIGH

Key Information:

Vendor

Eclipse Foundation

Status
Vendor
CVE Published:
15 October 2026

What is CVE-2026-18661?

Eclipse Jetty, which includes jetty-annotations and jetty-eeN-annotations, contains a vulnerability that affects the application of security constraints specified in web.xml. When multiple url-pattern definitions exist for a servlet, the Jakarta Spec rules are not consistently enforced for @ServletSecurity annotations. This issue can lead to improper access control, allowing unauthorized users to access protected resources under certain conditions.

References

https://github.com/jetty/jetty.project/security/advisorie...
https://gitlab.eclipse.org/security/cve-assignment/-/work...

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Reported by https://github.com/4ra1n
.