CVE-2026-18659

A flaw was found in Eclipse Jetty. A remote attacker can bypass security constraints by sending HTTP requests containing substrings of configured HTTP methods when method omission rules are used. This issue allows unauthorized users to access protected resources and endpoints that should be restricted.

A flaw was found in org.eclipse.jetty/jetty-security. In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat recommends updating org.eclipse.jetty/jetty-security to the latest version when a fix is available.