CVE-2026-18661

Description

In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.

Affected products

Vendor	Product	Affected	Fixed
Eclipse Foundation	org.eclipse.jetty.ee11:jetty-ee11-annotations	12.1.0 – ≤ 12.1.11	—
Eclipse Foundation	org.eclipse.jetty.ee10:jetty-ee10-annotations	12.1.0 – ≤ 12.1.11, 12.0.0 – ≤ 12.0.38	—
Eclipse Foundation	org.eclipse.jetty.ee9:jetty-ee9-annotations	12.1.0 – ≤ 12.1.11, 12.0.0 – ≤ 12.0.38	—
Eclipse Foundation	org.eclipse.jetty.ee8:jetty-ee8-annotations	12.1.0 – ≤ 12.1.11, 12.0.0 – ≤ 12.0.38	—
Eclipse Foundation	org.eclipse.jetty:jetty-annotations	11.0.0 – ≤ 11.0.32, 10.0.0 – ≤ 10.0.32, 9.4.0 – ≤ 9.4.64	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	jetty12	12.0.39-1	—
Debian 14	jetty9	No fix yet	—
Debian 13	jetty9 +1	No fix yet	—
Debian 12	jetty9	No fix yet	—

Ubuntu