CVE-2026-18662: 
Java vulnerability analysis and mitigation

CVE-2026-18662 is an authorization bypass vulnerability in Eclipse Jetty's security constraint handling, where duplicate HTTP method-omission constraint mappings with the same omission set are not properly combined per the Jakarta Servlet Specification. Instead of merging constraints, later mappings unconditionally overwrite earlier ones, making authorization decisions dependent on descriptor processing order. The vulnerability affects jetty-security (versions 7.6.13–9.4.64, 10.0.0–10.0.32, 11.0.0–11.0.32), and jetty-eeN-security/jetty-eeN-servlet modules (versions 12.0.0–12.0.38 and 12.1.0–12.1.11). It was disclosed on October 15, 2026, with a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Jetty Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-863 (Incorrect Authorization) and CWE-425 (Direct Request / Forced Browsing). In ConstraintSecurityHandler.processConstraintMapping(), ordinary constraint mappings are correctly combined via combineServletConstraints(), but method-omission mappings take a separate code path that constructs a key and unconditionally replaces any constraint already stored under that key (mappings.put(sb.toString(), mapping.getConstraint())). This bypasses the combination logic that would otherwise allow a FORBIDDEN constraint to override a permissive one. When two mappings both omit the same HTTP method (e.g., GET) on the same path, the constraint processed last wins — meaning a permissive ALLOWED mapping processed after a FORBIDDEN one results in unauthorized access to non-omitted methods (e.g., POST). The attacker does not control descriptor order; the vulnerability is exploitable only in applications whose static configuration already contains colliding method-omission mappings (Jetty Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass declarative servlet authorization controls and invoke protected HTTP endpoints using non-omitted methods (e.g., POST) that should have been denied. The confidentiality and integrity impacts are both rated Low — an attacker may access restricted resources or modify application state depending on what the protected endpoint exposes. Availability is not impacted. The actual business impact depends entirely on the functionality behind the protected endpoint; the vulnerability itself removes the authorization gate rather than directly exfiltrating data (Jetty Advisory, Red Hat Bugzilla).

A proof-of-concept (PoC) exploit is publicly available in the official Jetty security advisory as a complete, runnable Java class (DuplicateMethodOmissionConstraintLab.java) that demonstrates the authorization bypass by setting up an embedded Jetty server with conflicting security constraints and confirming order-dependent HTTP responses (200 vs. 403) (Jetty Advisory). The NVD SSVC assessment classifies the vulnerability as automatable with a PoC exploitation status. The EPSS score is approximately 0.40%, and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion as of the disclosure date. No threat actor attribution has been reported.

1. Identify a vulnerable deployment: Locate a Jetty application (versions 7.6.13–9.4.64, 10.0.0–10.0.32, 11.0.0–11.0.32, or 12.0.0–12.1.11) whose security configuration contains two or more ConstraintMapping entries that share the same HTTP method-omission set (e.g., both omit GET) on the same path pattern, where a permissive (ALLOWED) mapping is processed after a restrictive (FORBIDDEN) mapping.
2. Confirm constraint ordering: Review the application's deployment descriptor (web.xml) or programmatic security configuration to verify that the permissive method-omission mapping appears after the restrictive one — this is the precondition for the bypass to be effective.
3. Send a request using a non-omitted method: Issue an HTTP request using a method not in the omission set (e.g., POST) to the protected path (e.g., POST /admin/action). Because the ALLOWED constraint overwrote the FORBIDDEN one during initialization, Jetty will not enforce the intended restriction.
4. Observe unauthorized access: The server returns HTTP 200 and executes the protected handler instead of returning HTTP 403, confirming the authorization bypass (Jetty Advisory).

• Logs: Unexpected HTTP 200 responses in Jetty access logs for requests to paths that should be protected (e.g., /admin/*) using non-omitted methods (e.g., POST, PUT, DELETE) from unauthenticated or low-privilege clients.
• Configuration: Presence of two or more <security-constraint> entries in web.xml or programmatic ConstraintMapping objects that share the same <http-method-omission> set and apply to the same URL pattern — this is the static precondition for the vulnerability to be exploitable.
• Network: Unauthenticated POST, PUT, or DELETE requests to administratively protected paths (e.g., /admin/, /api/secure/) that return 2xx status codes rather than 401/403.

Upgrade to the following patched versions: org.eclipse.jetty:jetty-security to 9.4.65, 10.0.33, or 11.0.33; jetty-ee8-security, jetty-ee9-security, jetty-ee10-servlet, and jetty-ee11-servlet to 12.0.39 or 12.1.12 (Jetty Advisory). As a configuration-level workaround, audit all deployment descriptors and programmatic security configurations to eliminate duplicate method-omission constraint mappings with the same omission set on the same path — ensure each method-omission key is used by only one constraint mapping. End-of-life Jetty releases can be commercially supported through Webtide, HeroDevs, or TuxCare.

Red Hat opened a tracking bug (BZ-2553177) and assigned medium severity, with 56 CC'd engineers across multiple product teams indicating broad internal impact assessment (Red Hat Bugzilla). The Jetty project advisory drew comparisons to similar constraint-combination failures in Apache Tomcat (CVE-2026-43515, CVE-2018-1305), framing this as a known class of servlet container security vulnerability (Jetty Advisory). No significant social media commentary or independent researcher analysis has been publicly noted beyond standard CVE aggregator coverage.