CVE-2026-18662: CWE-863

In Eclipse Jetty versions 9.4.0 through 9.4.64, 10.0.0 through 10.0.32, 11.0.0 through 11.0.32, 12.0.0 through 12.0.38, and 12.1.0 through 12.1.11, the jetty-security and jetty-eeN-security modules do not properly combine two or more security constraints that have identical http-method-omission sets and no URL patterns. According to the Jakarta Servlet Specification, such constraints should be combined correctly, but in these versions, later constraints override previous ones. This behavior can lead to unintended security policy weakening where some HTTP methods might be improperly allowed or denied.

The vulnerability can result in security constraints being overridden improperly, which may allow HTTP methods that should be restricted or block methods that should be allowed. This misconfiguration could lead to unauthorized access or denial of service depending on how security constraints are defined and used in the affected Jetty server deployments.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, carefully review security constraint configurations involving http-method-omission sets and avoid relying on multiple constraints with the same omission sets and no URL patterns.