All vulnerabilities
CVE-2026-18659GHSA-53x7-f9fc-h7qr

org.eclipse.jetty.ee8:jetty-ee8-security: Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring

Eclipse Foundation org.eclipse.jetty.ee8:jetty-ee8-securityWeb servers
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 36% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in12.0.39Also 12.1.12, 11.0.33 and 2 moreGitHub
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 12.0.39org.eclipse.jetty.ee8:jetty-ee8-security, mavenGitHub<dependency><groupId>org.eclipse.jetty.ee8</groupId><artifactId>jetty-ee8-security</artifactId><version>12.0.39</version></dependency>
  • 12.0.39org.eclipse.jetty.ee9:jetty-ee9-security, mavenGitHub<dependency><groupId>org.eclipse.jetty.ee9</groupId><artifactId>jetty-ee9-security</artifactId><version>12.0.39</version></dependency>
  • 12.0.39org.eclipse.jetty.ee10:jetty-ee10-servlet, mavenGitHub<dependency><groupId>org.eclipse.jetty.ee10</groupId><artifactId>jetty-ee10-servlet</artifactId><version>12.0.39</version></dependency>
  • 12.1.12org.eclipse.jetty.ee8:jetty-ee8-security, mavenGitHub<dependency><groupId>org.eclipse.jetty.ee8</groupId><artifactId>jetty-ee8-security</artifactId><version>12.1.12</version></dependency>
  • 12.1.12org.eclipse.jetty.ee9:jetty-ee9-security, mavenGitHub<dependency><groupId>org.eclipse.jetty.ee9</groupId><artifactId>jetty-ee9-security</artifactId><version>12.1.12</version></dependency>
  • 12.1.12org.eclipse.jetty.ee10:jetty-ee10-servlet, mavenGitHub<dependency><groupId>org.eclipse.jetty.ee10</groupId><artifactId>jetty-ee10-servlet</artifactId><version>12.1.12</version></dependency>
Show all 10 fixed versions
  • 12.1.12org.eclipse.jetty.ee11:jetty-ee11-servlet, mavenGitHub<dependency><groupId>org.eclipse.jetty.ee11</groupId><artifactId>jetty-ee11-servlet</artifactId><version>12.1.12</version></dependency>
  • 11.0.33org.eclipse.jetty:jetty-security, mavenGitHub<dependency><groupId>org.eclipse.jetty</groupId><artifactId>jetty-security</artifactId><version>11.0.33</version></dependency>
  • 10.0.33org.eclipse.jetty:jetty-security, mavenGitHub<dependency><groupId>org.eclipse.jetty</groupId><artifactId>jetty-security</artifactId><version>10.0.33</version></dependency>
  • 9.4.65org.eclipse.jetty:jetty-security, mavenGitHub<dependency><groupId>org.eclipse.jetty</groupId><artifactId>jetty-security</artifactId><version>9.4.65</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods.

Text from CVE List

Affected versions 15

  • Eclipse Foundationaffected: 12.1.0 through 12.1.11CVE List
  • Eclipse Foundationaffected: 12.0.0 through 12.0.38CVE List
  • Eclipse Foundationaffected: 11.0.0 through 11.0.32CVE List
  • Eclipse Foundationaffected: 10.0.0 through 10.0.32CVE List
  • Eclipse Foundationaffected: 7.6.13 through 9.4.64CVE List
  • org.eclipse.jetty.ee8:jetty-ee8-security, maven>=12.0.0, <=12.0.38GitHub
  • org.eclipse.jetty.ee9:jetty-ee9-security, maven>=12.0.0, <=12.0.38GitHub
  • org.eclipse.jetty.ee10:jetty-ee10-servlet, maven>=12.0.0, <=12.0.38GitHub
  • org.eclipse.jetty.ee8:jetty-ee8-security, maven>=12.1.0, <=12.1.11GitHub
  • org.eclipse.jetty.ee9:jetty-ee9-security, maven>=12.1.0, <=12.1.11GitHub
  • org.eclipse.jetty.ee10:jetty-ee10-servlet, maven>=12.1.0, <=12.1.11GitHub
  • org.eclipse.jetty.ee11:jetty-ee11-servlet, maven>=12.1.0, <=12.1.11GitHub
  • org.eclipse.jetty:jetty-security, maven>=11.0.0, <=11.0.32GitHub
  • org.eclipse.jetty:jetty-security, maven>=10.0.0, <=10.0.32GitHub
  • org.eclipse.jetty:jetty-security, maven>=7.6.13, <=9.4.64GitHub

References 2