CVE-2026-18662

A flaw was found in Eclipse Jetty. When multiple security constraints are configured with identical HTTP method omission definitions and no URL patterns, the server improperly overrides earlier constraints rather than combining their rules as required by the Jakarta Servlet specification. A remote attacker can exploit this vulnerability to bypass intended access control restrictions and gain unauthorized access to protected web application resources.

A flaw was found in org.eclipse.jetty/jetty-security. In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec.

Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set. Prerequisites: Standard deployment configuration CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). None -- NVD score appropriate Exploitation scenario: No exploitation steps identified. Exploitation difficulty: MEDIUM. This issue affects amq-7, exploit-intelligence, fedora-all, fuse-7, ocp-tools-4, offline-knowledge-portal-1, openshift-ai, openshift-hosted-osd4, rhboac-hawtio-4, rhel-7, rhel-9, rhel-br-10, rhint-camel-spring-boot-4, rhint-debezium-3, rhint-serv-3, rhn_satellite_6, rhos_devspaces-3, services-management-platform, services-remediations-platform. Red Hat has rated this as having moderate impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat recommends updating org.eclipse.jetty/jetty-security to the latest version when a fix is available.