CVE-2026-18659
Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring
Published Oct 15, 2026 · updated Oct 15, 2026 · Eclipse Foundation
In Eclipse Jetty, across various versions of , and , and , the Jakarta Spec constraints defined as can be bypassed by using substrings of the defined HTTP Methods.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
In Eclipse Jetty, across various versions of , and , and , the Jakarta Spec constraints defined as can be bypassed by using substrings of the defined HTTP Methods.
Oct 15, 2026 · NIST NVD
Updated
In Eclipse Jetty, across various versions of , and , and , the Jakarta Spec constraints defined as can be bypassed by using substrings of the defined HTTP Methods.
Oct 15, 2026 · NIST NVD
Updated
In Eclipse Jetty, across various versions of , and , and , the Jakarta Spec constraints defined as can be bypassed by using substrings of the defined HTTP Methods.
Affected
- vendor Eclipse Foundationversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-18659
In Eclipse Jetty, across various versions of , and , and , the Jakarta Spec constraints defined as can be bypassed by using substrings of the defined HTTP Methods.
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-18659
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-18659
30-day exploitation probability 0.4%
first.org - NIST NVDVulnerability recordCVE-2026-18659
In Eclipse Jetty, across various versions of , and , and , the Jakarta Spec constraints defined as can be bypassed by using substrings of the defined HTTP Methods.
nvd.nist.gov