CVE-2026-18662

TuxCare security update for 123 packages (8 CVEs)

6.9 MediumFix available

Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.39%Unchanged since Oct 15, 2026

What each source reports

CVE List Score used 6.9

Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.

Record: CVE-2026-18662
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-863
Updated: 2026-11-02

EUVDEUVD-2026-101995 6.9

Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.

Record: EUVD-2026-101995
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

NVD 6.9

Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.

Record: CVE-2026-18662
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-863
Updated: 2026-11-02

OSV 6.9

Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.

Record: CVE-2026-18662
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-863
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-18662 6.9

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.

Record: DEBIAN-CVE-2026-18662
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-04

OSVUBUNTU-CVE-2026-18662 6.9

Record: UBUNTU-CVE-2026-18662
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVCLSA-2026-1790290763 No score

TuxCare security update for 123 packages (8 CVEs)

TuxCare rebuilt 123 packages to address 8 CVEs. Fixed in 10.0.33.tuxcare0001.

Record: CLSA-2026-1790290763
Updated: 2026-11-02

OSVCLSA-2026-1790305167 No score

TuxCare security update for 123 packages (8 CVEs)

TuxCare rebuilt 123 packages to address 8 CVEs. Fixed in 11.0.33.tuxcare0001.

Record: CLSA-2026-1790305167
Updated: 2026-11-02

OSVCLSA-2026-1790774766 No score

TuxCare security update for 86 packages (8 CVEs)

TuxCare rebuilt 86 packages to address 8 CVEs. Fixed in 9.4.65.tuxcare0001.

Record: CLSA-2026-1790774766
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`org.eclipse.jetty.demos:demo-async-rest-jar` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-container-initializer` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jaas-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jetty-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jndi-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jsp-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-mock-resources` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001

Show 204 moreShow less

Affected packages
Package	Affected	Fixed
`org.eclipse.jetty.demos:demo-proxy-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-simple-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-spec` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-spec-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-web-fragment` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demos-jetty-embedded` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demos-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.documentation:code-examples` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.documentation:documentation-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.documentation:jetty` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.gcloud:gcloud-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.gcloud:jetty-gcloud-session-manager` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-hpack` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-http-client-transport` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-http-client-transport` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-qpack` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.memcached:jetty-memcached-sessions` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.memcached:memcached-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-httpservice` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-alpn` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-jsp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-warurl` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-project` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.osgi:test-jetty-osgi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-foreign-incubator` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-jna` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-javax-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-javax-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-javax-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-api` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-servlet` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:apache-jsp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:apache-jstl` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-embedded` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-embedded-query` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-remote` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-remote-query` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-java-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-java-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-parent` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-annotations` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-ant` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-bom` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-cdi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-deploy` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-hazelcast` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-home` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-http` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-http-spi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-io` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jaas` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jaspi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jmx` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jndi` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-jspc-maven-plugin` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-keystore` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-maven-plugin` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-nosql` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-openid` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-p2` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-plus` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-project` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-proxy` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-quickstart` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-rewrite` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-runner` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-security` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-servlet` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-servlets` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-slf4j-impl` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-start` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixdomain-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket-client` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket-common` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket-server` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-util` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-util-ajax` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-webapp` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty:jetty-xml` TuxCare:Maven From an advisory covering 8 CVEs	10.0.33 up to 10.0.33.tuxcare0001	10.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-jar` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-container-initializer` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jaas-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jetty-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jndi-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-jsp-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-mock-resources` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-proxy-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-simple-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-spec` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-spec-webapp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demo-web-fragment` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demos-jetty-embedded` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.demos:demos-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.documentation:code-examples` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.documentation:documentation-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.documentation:jetty` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.gcloud:gcloud-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.gcloud:jetty-gcloud-session-manager` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-hpack` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-http-client-transport` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http2:http2-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-http-client-transport` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-qpack` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.http3:http3-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.memcached:jetty-memcached-sessions` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.memcached:memcached-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-httpservice` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-alpn` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-jsp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-warurl` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-project` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.osgi:test-jetty-osgi` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-foreign-incubator` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-jna` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.quic:quic-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jakarta-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jakarta-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jakarta-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-api` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty.websocket:websocket-servlet` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:apache-jsp` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:glassfish-jstl` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-common` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-embedded` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-embedded-query` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-parent` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-remote` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:infinispan-remote-query` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-client` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-server` TuxCare:Maven From an advisory covering 8 CVEs	11.0.33 up to 11.0.33.tuxcare0001	11.0.33.tuxcare0001
`jetty12` Debian:13	All versions, plus listed versions 12.0.17-312.0.17-3.112.0.17-3.1~deb13u112.0.32-112.0.32-2 Show 4 moreShow less 12.0.33-112.0.39-112.0.40-112.0.40-2	None known
`jetty12` Debian:14	before 12.0.39-1, plus listed versions 12.0.17-312.0.17-3.112.0.17-3.1~deb13u112.0.32-112.0.32-212.0.33-1	12.0.39-1
`jetty9` Debian:12	All versions, plus listed versions 9.4.50-49.4.50-4+deb12u19.4.50-4+deb12u29.4.50-4+deb12u39.4.51-1 Show 13 moreShow less 9.4.51-29.4.52-19.4.53-19.4.54-19.4.55-19.4.56-19.4.57-0+deb12u19.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2	None known
`jetty9` Debian:13	All versions, plus listed versions 9.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2	None known
`jetty9` Debian:14	All versions, plus listed versions 9.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2	None known
`jetty9` Ubuntu:16.04:LTS	All versions, plus listed versions 9.2.14-1	None known
`jetty9` Ubuntu:18.04:LTS	All versions, plus listed versions 9.2.22-29.2.22-39.2.23-19.4.15-1~18.04.1ubuntu1	None known
`jetty9` Ubuntu:20.04:LTS	All versions, plus listed versions 9.4.18-2build29.4.26-1	None known
`jetty9` Ubuntu:22.04:LTS	All versions, plus listed versions 9.4.39-39.4.44-29.4.44-39.4.44-49.4.45-1	None known
`jetty9` Ubuntu:24.04:LTS	All versions, plus listed versions 9.4.51-29.4.53-1	None known
`jetty12` Ubuntu:26.10	All versions, plus listed versions 12.0.32-1	None known
`jetty9` Ubuntu:26.10	All versions, plus listed versions 9.4.58-19.4.58-2	None known
`jetty12` Ubuntu:26.04:LTS	All versions, plus listed versions 12.0.17-3.112.0.32-1	None known
`jetty9` Ubuntu:26.04:LTS	All versions, plus listed versions 9.4.57-19.4.57-1.19.4.58-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 4, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-18662 is a medium vulnerability (CVSS 6.9) in org.eclipse.jetty.demos:demo-async-rest-jar, published September 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in jetty12 12.0.39-1.

References

This page doesn't list everything

Also not on the record: 132 package claims. ID and package lookups still check them.