CVE-2026-18659: CWE-863

Eclipse Jetty versions from 9.4.0 up to and including 9.4.64, 10.0.0 up to 10.0.32, 11.0.0 up to 11.0.32, 12.0.0 up to 12.0.38, and 12.1.0 up to 12.1.11 are affected by a vulnerability where the Jakarta Spec 'http-method-omission' constraints can be bypassed by using substrings of HTTP methods. This allows bypassing intended HTTP method restrictions, potentially leading to unauthorized HTTP method usage. The vulnerability is tracked as CWE-863 (Incorrect Authorization). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality and integrity impact and limited availability impact.

The vulnerability allows bypassing HTTP method restrictions defined by the Jakarta Spec constraints in Jetty, potentially enabling unauthorized HTTP methods to be accepted. This could lead to unintended behavior or access control issues in applications relying on these constraints. The CVSS score of 6.9 reflects a medium severity impact, with limited confidentiality, integrity, and availability impacts. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Eclipse Jetty advisories for updates. In the meantime, review and test HTTP method constraints carefully to detect potential bypasses and consider additional application-level controls to enforce HTTP method restrictions.