MEDIUM 6.9 NVD
CVE-2026-18662
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec.
Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.
References
- https://github.com/jetty/jetty.project/security/advisories/GHSA-phjh-v7c6-g7mv
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/210
- https://github.com/jetty/jetty.project/security/advisories/GHSA-phjh-v7c6-g7mv
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-10-15 via NVD.
vulnfeed aggregates 14529 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.