CVE-2026-18662

A flaw was found in Eclipse Jetty. When multiple security constraints are configured with identical HTTP method omission definitions and no URL patterns, the server improperly overrides earlier constraints rather than combining their rules as required by the Jakarta Servlet specification. A remot...

Fixed in Apache Tomcat 9.0.71

Important: Apache Tomcat denial of service CVE-2023-24998 Apache Tomcat uses a packaged renamed copy of Apache Commons FileUpload to provide the file upload functionality defined in the Jakarta Servlet specification. Apache Tomcat was, therefore, also vulnerable to the Apache Commons FileUpload...