The vulnerability allows attackers to bypass HTTP method constraints that are configured as 'http-method-omission' in Eclipse Jetty’s ConstraintSecurityHandler. By sending a request whose method contains a substring of a protected HTTP method, the constraint does not recognize the request as matching the restricted method, and the access control is bypassed. This means an attacker can read or modify resources that should only be reachable with specific HTTP methods, leading to unauthorized access or elevated privileges.

Eclipse Jetty servers that use the jetty-security, jetty-eeN-security, or jetty-eeN-servlet modules are affected. The issue exists across various versions of these modules, so any instance of Jetty running these components may be vulnerable. Users should verify whether their Jetty deployment includes the affected modules and check for any vendor‑issued fixes for the specific version in use.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% implies a low likelihood that attackers currently target this flaw. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the defect remotely by crafting HTTP requests with method names that contain substrings of protected methods, which is inferred from the described bypass mechanism. The exploit does not require authentication and thus poses a direct risk to all unauthenticated users accessing the server.