Read the docs
TI-2026-74683 Aliases CVE-2026-18661

Eclipse Jetty annotations fail to apply some security constraints

Priority HIGH 77CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

Eclipse Jetty jetty-annotations 9.4.0 through 9.4.64, 10.0.0 through 10.0.32 and 11.0.0 through 11.0.32, and jetty-eeN-annotations 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11 are affected. Mixed @ServletSecurity and web.xml security constraints on the same url-pattern are not applied when a servlet has several url-patterns and only some are constrained (CWE-863). A remote unauthenticated attacker can reach resources that the constraints should protect.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00424 36th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse Foundationorg.eclipse.jetty.ee11:jetty-ee11-annotations12.1.0 – 12.1.11—No fix listedCNA
Eclipse Foundationorg.eclipse.jetty.ee10:jetty-ee10-annotations12.1.0 – 12.1.11; 12.0.0 – 12.0.38—No fix listedCNA
Eclipse Foundationorg.eclipse.jetty.ee9:jetty-ee9-annotations12.1.0 – 12.1.11; 12.0.0 – 12.0.38—No fix listedCNA
Eclipse Foundationorg.eclipse.jetty.ee8:jetty-ee8-annotations12.1.0 – 12.1.11; 12.0.0 – 12.0.38—No fix listedCNA
Eclipse Foundationorg.eclipse.jetty:jetty-annotations11.0.0 – 11.0.32; 10.0.0 – 10.0.32; 9.4.0 – 9.4.64—No fix listedCNA
  • org.eclipse.jetty.ee11:jetty-ee11-annotations VendorEclipse Foundation Affected 12.1.0 – 12.1.11 Fixed in — No fix listed CNA
  • org.eclipse.jetty.ee10:jetty-ee10-annotations VendorEclipse Foundation Affected 12.1.0 – 12.1.11; 12.0.0 – 12.0.38 Fixed in — No fix listed CNA
  • org.eclipse.jetty.ee9:jetty-ee9-annotations VendorEclipse Foundation Affected 12.1.0 – 12.1.11; 12.0.0 – 12.0.38 Fixed in — No fix listed CNA
  • org.eclipse.jetty.ee8:jetty-ee8-annotations VendorEclipse Foundation Affected 12.1.0 – 12.1.11; 12.0.0 – 12.0.38 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-annotations VendorEclipse Foundation Affected 11.0.0 – 11.0.32; 10.0.0 – 10.0.32; 9.4.0 – 9.4.64 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for org.eclipse.jetty:jetty-annotations. The sources list no fixed version for org.eclipse.jetty.ee8:jetty-ee8-annotations, org.eclipse.jetty.ee9:jetty-ee9-annotations, org.eclipse.jetty.ee10:jetty-ee10-annotations or org.eclipse.jetty.ee11:jetty-ee11-annotations. Red Hat lists Red Hat Enterprise Linux 8 and 9, Red Hat Fuse 7, Red Hat OpenShift Dev Spaces, Red Hat build of Apache Camel - HawtIO 4 and Red Hat build of Apache Camel for Spring Boot 4 as affected without a fix and with no plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-18661
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat

References

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
  • TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
  • TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
  • TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
  • TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences