Bug 2553182 (CVE-2026-18659)
| Summary: | CVE-2026-18659 org.eclipse.jetty/jetty-security: Eclipse Jetty: Security constraint bypass via HTTP method substrings | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abrianik, anthomas, asyoung, ataylor, ccranfor, csuconic, dbruscin, dfreiber, drow, ehelms, ewittman, fmariani, ggainey, ggrzybek, gmalinko, gtully, janstey, jburrell, jhollowa, jpasqual, jpechane, jraez, jsherman, juwatts, jwon, kaycoth, kvanderr, mcarlett, mdellweg, mhulan, nipatil, nmoumoul, osousa, pantinor, parichar, pcreech, pdelbell, pjindal, prichard, rchan, rgemmell, rgodfrey, rhel-process-autobot, rkubis, rstepani, sdawley, smallamp, sthirugn, tasato, tbish, tcunning, tlavocat, tmalecek, vkumar, watson-tool-maintainers, yfang |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Eclipse Jetty. A remote attacker can bypass security constraints by sending HTTP requests containing substrings of configured HTTP methods when method omission rules are used. This issue allows unauthorized users to access protected resources and endpoints that should be restricted.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-15 09:52:44 UTC
|