Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to improper handling of hostnames in the proxy process. An attacker can bypass access restrictions by supplying hostnames that differ only in letter casing. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the EthereumAuthenticator process. An attacker can gain unauthorized access to protected resources by crafting a request path that includes the configured login path as a later...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the EthereumAuthenticator process. An attacker can gain unauthorized access to protected resources by crafting a request path that includes the configured login path as a later...

Cleartext Storage of Sensitive Information

Overview org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information via the SessionAuthentication process. An attacker can access plaintext passwords of authenticated...

CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...