EUVD-2026-101996Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify method-constrained endpoint
-
ExploitCraft request with HTTP-method substring
-
ExecutionBypass http-method-omission authorization
-
ImpactAccess/modify restricted resource
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to enforce Jakarta declarative security constraints that use 'http-method-omission' to restrict access by HTTP method, running on an affected Jetty security/servlet module. The bypass works by submitting requests with substrings of the defined HTTP methods so they evade the omission rule. Limiting factors: applications that do not use method-based ('http-method-omission') constraints are not affected, and the impact is confined to resources protected specifically by that mechanism rather than the whole server. Per the CVSS vector no authentication or user interaction is needed, making it remotely reachable against any affected app that uses this constraint type. |
| Impact | This is a moderate-severity authorization bypass (CWE-863) in Eclipse Jetty's security modules. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) scores 6.9 and indicates a network-reachable, low-complexity flaw requiring no privileges or user interaction, but with only LOW confidentiality and integrity impact and no availability impact - consistent with bypassing access controls on specific constrained resources rather than full compromise. No EPSS score was provided, there is no CISA KEV listing, and no public POC is referenced, so there is no evidence of active or imminent mass exploitation. The real risk is conditional: it only matters where applications rely on Jakarta declarative security constraints using 'http-method-omission', so it is a genuine but bounded priority - meaningful for Jetty-hosted apps using method-based authorization, low practical risk for deployments that do not use that constraint mechanism. The PR:N/AV:N profile makes it easy to exploit where applicable, which should raise urgency for affected configurations despite the only-LOW impact metrics. |
| Exploit ScenarioDerived | An attacker sends an HTTP request using a substring or alternate casing of a protected HTTP method (e.g. a crafted variant that is not matched by the configured 'http-method-omission' constraint) to a Jetty-hosted application that enforces Jakarta security constraints. Because Jetty fails to canonicalize the method against the omission rule, the request slips past the authorization check and reaches a resource that should have been restricted. No public exploit code is referenced at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Authorization bypass in Eclipse Jetty's declarative security layer lets unauthenticated remote attackers reach resources that a Jakarta security constraint was supposed to protect when that constraint is expressed with 'http-method-omission'. The flaw affects the jetty-security module together with the jetty-eeN-security and jetty-eeN-servlet modules bundled across multiple Jetty release lines, but only for applications that actually use method-omission constraints; the impact is scoped to those protected resources rather than the whole server. The vendor-assigned CVSS 4.0 score is 6.9 and our independent assessment rates it a moderate-severity CWE-863 authorization bypass reachable over the network with no authentication and no user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N); no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
RemediationAI
Upgrade to a Jetty release that contains the fix described in the vendor advisory GHSA-53x7-f9fc-h7qr (also tracked via the Eclipse security work item at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/214); the exact fixed version numbers were not supplied in the available data, so confirm the specific patched version for your Jetty line on the advisory page before upgrading - a patch is available per the vendor advisory, but no fixed version is independently confirmed here. If immediate upgrading is not possible, rewrite the affected security constraints to avoid <http-method-omission> entirely: replace each omission rule with explicit <http-method> enumeration of every method that should be allowed (or denied) so authorization no longer depends on the broken omission matcher, accepting the trade-off that the allow-list must be maintained and re-reviewed whenever new HTTP methods are introduced. As a second compensating control, put an exact-match method filter in front of the security handler - either a servlet Filter mapped ahead of the constraint or a rule at the edge proxy/WAF - that rejects any request whose method token is not byte-for-byte identical to a known list (GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH); this neutralizes substring tricks and unusual tokens, with the trade-offs of added latency, added rule maintenance, potential breakage of WebDAV or custom/extension methods, and no protection for traffic that bypasses the intermediary. Because exploitation is unauthenticated and leaves a distinctive method token in the request line, enable and monitor access logging for non-standard or truncated HTTP methods as a detective control, and treat any such request that reached a protected resource as a potential authorization bypass for incident response purposes.
Affected ProductsAI
Eclipse Jetty security modules are affected across various versions: per the vendor description, the vulnerable code lives in jetty-security, the jetty-eeN-security variants, and the jetty-eeN-servlet variants, spanning multiple Jetty release lines that ship the declarative security constraint implementation. The advisory text deliberately refers to 'various versions' rather than enumerating exact ranges, and the multi-source input supplied here contains no CPE strings, so precise affected version boundaries cannot be confirmed from this data alone; consult the Eclipse/Jetty GitHub security advisory GHSA-53x7-f9fc-h7qr and the Eclipse CVE assignment work item at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/214 for the authoritative list of affected and fixed Jetty releases and for the corresponding Maven coordinates (org.eclipse.jetty:jetty-security and the ee9/ee10/ee11 security and servlet artifacts). Downstream consumers of Jetty - embedded server deployments, servlet containers, and frameworks that bundle Jetty rather than pulling it directly - should be inventoried as well, since they inherit the flaw through the transitively included jetty-security module.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in the Jakarta Servlet declarative security model, where access rules are declared in web.xml (or equivalent) inside <security-constraint> blocks. Constraints can be scoped by HTTP method in two ways: <http-method> enumerates the methods the constraint applies to, while <http-method-omission> enumerates methods the constraint explicitly does NOT apply to (so the constraint covers everything else). Jetty's implementation of that matching logic in jetty-security and the eeN security/servlet modules is vulnerable to a substring comparison: a request whose method token is a substring of a method named in the omission list is incorrectly treated as that omitted method, so the constraint is skipped entirely and the request is handed to the protected resource. This is a classic CWE-863 incorrect authorization defect - the matching routine fails to enforce exact, case-sensitive equality on the method token as the specification requires, turning a method-scoping rule into a bypass. Because the method token is attacker-controlled in the HTTP request line, no credentials or user interaction are needed, and the assessed vector confirms PR:N/UI:N with low confidentiality and integrity impact (C:L/I:L) and no availability impact. Applications that rely on <http-method> allow-lists instead of omission rules, or that do not use declarative method-based constraints at all, are not affected by this specific bug. Practical exploitation also requires the crafted method token to survive any intermediary - reverse proxies, load balancers or WAFs that reject or normalize non-standard method tokens can interfere with the attack, which is a meaningful limiting factor in hardened deployments.
Know when Jetty gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Remotely reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N); bypass exposes/modifies only specific constrained resources, so C:L/I:L, no availability impact, no scope change.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
DescriptionCVE.org
In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive informat
Eclipse Jetty provides a web server and servlet container. Rated high severity (CVSS 7.5), this vulnerability is remotel
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffer
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon re
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote atta
Protected resources in Eclipse Jetty deployments that enable the EthereumAuthenticator can be reached without authentica
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . Rated medium severity (CVSS
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characte
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doub
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contai
Exploit-DB