CVE-2026-18659

Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring

6.9 MediumFix available

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.41%Unchanged since Oct 15, 2026

What each source reports

CVE List Score used 6.9

Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring

Record: CVE-2026-18659
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-863
Updated: 2026-11-02

EUVDEUVD-2026-101996 6.9

Record: EUVD-2026-101996
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

NVD 6.9

Record: CVE-2026-18659
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-863
Updated: 2026-11-02

OSV 6.9

Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring

Record: CVE-2026-18659
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-863
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-18659 6.9

Record: DEBIAN-CVE-2026-18659
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-04

OSVUBUNTU-CVE-2026-18659 6.9

Record: UBUNTU-CVE-2026-18659
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVCLSA-2026-1790290763 No score

TuxCare security update for 123 packages (8 CVEs)

TuxCare rebuilt 123 packages to address 8 CVEs. Fixed in 10.0.33.tuxcare0001.

Record: CLSA-2026-1790290763
Updated: 2026-11-02

OSVCLSA-2026-1790305167 No score

TuxCare security update for 123 packages (8 CVEs)

TuxCare rebuilt 123 packages to address 8 CVEs. Fixed in 11.0.33.tuxcare0001.

Record: CLSA-2026-1790305167
Updated: 2026-11-02

OSVCLSA-2026-1790774766 No score

TuxCare security update for 86 packages (8 CVEs)

TuxCare rebuilt 86 packages to address 8 CVEs. Fixed in 9.4.65.tuxcare0001.

Record: CLSA-2026-1790774766
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`org.eclipse.jetty.demos:demo-async-rest-jar` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-container-initializer` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jaas-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jetty-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jndi-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jsp-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-mock-resources` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001

Show 204 moreShow less

Affected packages
Package	Affected	Fixed
`org.eclipse.jetty.demos:demo-proxy-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-simple-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-spec` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-spec-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-web-fragment` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demos-jetty-embedded` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demos-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.documentation:code-examples` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.documentation:documentation-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.documentation:jetty` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.gcloud:gcloud-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.gcloud:jetty-gcloud-session-manager` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-hpack` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-http-client-transport` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-http-client-transport` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-qpack` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.memcached:jetty-memcached-sessions` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.memcached:memcached-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-httpservice` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-alpn` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-jsp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-warurl` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-project` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:test-jetty-osgi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-foreign-incubator` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-jna` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-javax-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-javax-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-javax-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-api` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-servlet` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:apache-jsp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:apache-jstl` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-embedded` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-embedded-query` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-remote` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-remote-query` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-java-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-java-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-annotations` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-ant` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-bom` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-cdi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-deploy` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-hazelcast` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-home` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-http` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-http-spi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-io` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jaas` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jaspi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jmx` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jndi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jspc-maven-plugin` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-keystore` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-maven-plugin` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-nosql` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-openid` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-p2` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-plus` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-project` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-proxy` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-quickstart` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-rewrite` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-runner` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-security` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-servlet` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-servlets` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-slf4j-impl` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-start` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixdomain-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-util` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-util-ajax` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-xml` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-jar` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-container-initializer` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jaas-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jetty-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jndi-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jsp-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-mock-resources` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-proxy-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-simple-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-spec` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-spec-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-web-fragment` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demos-jetty-embedded` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demos-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.documentation:code-examples` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.documentation:documentation-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.documentation:jetty` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.gcloud:gcloud-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.gcloud:jetty-gcloud-session-manager` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-hpack` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-http-client-transport` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-http-client-transport` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-qpack` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.memcached:jetty-memcached-sessions` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.memcached:memcached-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-httpservice` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-alpn` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-jsp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-warurl` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-project` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:test-jetty-osgi` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-foreign-incubator` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-jna` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jakarta-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jakarta-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jakarta-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-api` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-servlet` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:apache-jsp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:glassfish-jstl` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-embedded` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-embedded-query` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-remote` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-remote-query` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`jetty12` Debian:13	All versions, plus listed versions 12.0.17-312.0.17-3.112.0.17-3.1~deb13u112.0.32-112.0.32-2 Show 4 moreShow less 12.0.33-112.0.39-112.0.40-112.0.40-2	None known
`jetty12` Debian:14	before 12.0.39-1, plus listed versions 12.0.17-312.0.17-3.112.0.17-3.1~deb13u112.0.32-112.0.32-212.0.33-1	12.0.39-1
`jetty9` Debian:12	All versions, plus listed versions 9.4.50-49.4.50-4+deb12u19.4.50-4+deb12u29.4.50-4+deb12u39.4.51-1 Show 13 moreShow less 9.4.51-29.4.52-19.4.53-19.4.54-19.4.55-19.4.56-19.4.57-0+deb12u19.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2	None known
`jetty9` Debian:13	All versions, plus listed versions 9.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2	None known
`jetty9` Debian:14	All versions, plus listed versions 9.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2	None known
`jetty9` Ubuntu:16.04:LTS	All versions, plus listed versions 9.2.14-1	None known
`jetty9` Ubuntu:18.04:LTS	All versions, plus listed versions 9.2.22-29.2.22-39.2.23-19.4.15-1~18.04.1ubuntu1	None known
`jetty9` Ubuntu:20.04:LTS	All versions, plus listed versions 9.4.18-2build29.4.26-1	None known
`jetty9` Ubuntu:22.04:LTS	All versions, plus listed versions 9.4.39-39.4.44-29.4.44-39.4.44-49.4.45-1	None known
`jetty9` Ubuntu:24.04:LTS	All versions, plus listed versions 9.4.51-29.4.53-1	None known
`jetty12` Ubuntu:26.10	All versions, plus listed versions 12.0.32-1	None known
`jetty9` Ubuntu:26.10	All versions, plus listed versions 9.4.58-19.4.58-2	None known
`jetty12` Ubuntu:26.04:LTS	All versions, plus listed versions 12.0.17-3.112.0.32-1	None known
`jetty9` Ubuntu:26.04:LTS	All versions, plus listed versions 9.4.57-19.4.57-1.19.4.58-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 4, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-18659 is a medium vulnerability (CVSS 6.9) in org.eclipse.jetty.demos:demo-async-rest-jar, published September 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in jetty12 12.0.39-1.

References

This page doesn't list everything

Also not on the record: 132 package claims. ID and package lookups still check them.