Eclipse Jetty EUVD-2026-101995

Exploitation requires the target application's deployment (web.xml or programmatic Jakarta Servlet security config) to declare two or more security constraints that (a) share the identical http-method-omission set and (b) have no url-patterns defined; in that case the later constraint overrides earlier ones instead of being combined, dropping the intended authorization check. Limiting factors: the vulnerable overlapping-constraint pattern must actually be used by the application (default or single-constraint configurations are not affected), the resource must be network-reachable, and the running Jetty version must be an affected jetty-security / jetty-eeN-security build. No end-user interaction or attacker credentials are needed once a vulnerable configuration exists.

This is a medium-severity authorization-logic flaw (vendor CVSS 4.0 base 6.9) rather than a high-urgency item. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) implies network-reachable, unauthenticated triggering with low confidentiality and integrity impact and no availability impact - consistent with CWE-863 (Incorrect Authorization) and the 'Authentication Bypass' tag. However, the vector understates a key limiting factor: the flaw only manifests when the deployed application itself declares two or more Jakarta Servlet security constraints that share the same http-method-omission set and have no url-patterns. That is a specific, operator-introduced configuration precondition, so real-world exposure is far narrower than AV:N/PR:N alone suggests - I assess this as better modeled with AT:P (4.0) / AC:H (3.1). No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Net: a legitimate patch-management item for Jetty operators who use method-omission constraints, but not an emergency given the absence of exploitation signals and the configuration dependency.

A developer protects a servlet resource with multiple Jakarta security constraints that use the same http-method-omission set and omit url-patterns, expecting all of them to be enforced. Because Jetty's jetty-security merges them incorrectly, a later constraint silently overrides the earlier ones, so a remote attacker simply requests the resource over the network and reaches it without satisfying the intended authorization rule. No public exploit code is referenced; exploitation requires the specific overlapping-constraint configuration to be present.