Eclipse Jetty CVE-2026-18661

Exploitation requires a target application deployed on an affected Jetty version where: (1) a servlet is mapped to more than one url-pattern in web.xml, (2) a web.xml security-constraint applies to only some of those url-patterns, and (3) @ServletSecurity annotations are mixed with the web.xml-defined constraints. Under these conditions the Jakarta spec authoritative url-pattern rules are not applied, leaving certain patterns unprotected. The attacker side needs only remote, unauthenticated HTTP access (AV:N/PR:N/UI:N), but the vulnerability does NOT exist against default or single-pattern configurations - it is strictly gated by this specific application-level web.xml/annotation layout, which materially limits the exposed population.

This is a security-constraint/authorization bypass in Eclipse Jetty's annotation processing (jetty-annotations and jetty-eeN-annotations), flagged as Information Disclosure. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) rates it 8.8, indicating a remote, low-complexity, unauthenticated attack with high confidentiality impact and low integrity impact - consistent with an attacker reaching resources that should have been protected by a security-constraint. The real-world risk is tempered by a specific non-default prerequisite: the Jakarta spec url-pattern merge rules are only mishandled when a servlet has more than one url-pattern in web.xml AND a security-constraint covers only some of those patterns alongside @ServletSecurity annotations. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation; the SSVC framework cannot be fully evaluated because exploitation/automatable signals are absent. The headline PR:N (unauthenticated) rating reflects the attacker's position, but exploitability depends entirely on the victim application's web.xml configuration, so this is a genuine-but-conditional priority rather than a universally exploitable flaw - patch promptly on apps using mixed annotation/web.xml security constraints, but mass-scanning risk is lower than the raw score implies.

An attacker remotely requests a URL served by a Jetty-hosted application where a servlet is mapped to multiple url-patterns but a web.xml security-constraint only protects a subset of them, combined with @ServletSecurity annotations. Because the url-pattern merge rules are not applied, the attacker reaches the servlet via an unprotected pattern that should have been authorization-gated, retrieving protected content without credentials. No public exploit code was identified at time of analysis, and exploitation requires the specific multi-pattern/partial-constraint configuration to be present.