Security Misconfiguration in Eclipse Jetty Affects Web Applications

CVE-2026-18662

What is CVE-2026-18662?

In Eclipse Jetty, a misconfiguration exists in the processing of security constraints within the jetty-security and jetty-eeN-security modules. This issue arises when multiple security constraints share an identical set of http-method-omission without any defined url-patterns, leading to an improper combination of these constraints as per the Jakarta Servlet Specification. Consequently, the latter http-method-omission sets may inadvertently override previously defined constraints, creating potential security loopholes that could be exploited by malicious actors.

References