CVE-2026-18661 Eclipse Foundation CVE debrief

Who should care

Defenders responsible for Eclipse Jetty deployments should assess exposure and prioritize verification of affected versions and configurations. This includes reviewing url-pattern definitions and security-constraints in web.xml files, and considering applying patches or updates provided by the vendor. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-18661 is a high-severity vulnerability in Eclipse Jetty that may allow for security-constraint bypass in specific deployment contexts. Defenders should prioritize verification of affected versions and configurations, and assess exposure in their specific deployment contexts.

• Verification of affected versions and configurations is necessary to determine exposure.
• Security-constraint bypass may occur in specific deployment contexts.
• Defenders should review url-pattern definitions and security-constraints in web.xml files.

Technical summary

The vulnerability in Eclipse Jetty arises from the handling of mixed @ServletSecurity annotations and web.xml defined security-constraints. Specifically, when the web.xml file contains more than one url-pattern for a servlet and has a security-constraint applying to only some of those url-pattern definitions, the Jakarta Spec authoritative url-pattern rules are not being applied correctly. This may allow for security-constraint bypass in specific deployment contexts. Defenders should prioritize verification of affected versions and configurations, and assess exposure in their specific deployment contexts.

Defensive priority

Defenders should prioritize verification of affected versions and configurations, and assess exposure in their specific deployment contexts.

Recommended defensive actions

• Verify affected versions and configurations of Eclipse Jetty in your deployment context.
• Assess exposure by reviewing the specific url-pattern definitions and security-constraints in your web.xml files.
• Consider applying patches or updates provided by the vendor, if available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Eclipse Jetty, specifically in the handling of mixed @ServletSecurity annotations and web.xml defined security-constraints. The vulnerability has a CVSS score of 8.8 and is considered high-severity. Defenders should verify affected versions and configurations, review url-pattern definitions and security-constraints in web.xml files, and consider applying patches or updates provided by the vendor. The CVE record was published on 2026-10-15T09:17:17.270Z and has not

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.