In Eclipse Jetty versions that use jetty-annotations or jetty-eeN-annotations, the framework failed to enforce Jakarta Spec authoritative url-pattern rules when a servlet had both a @ServletSecurity annotation and a web.xml security-constraint that applied to some, but not all, of the servlet’s url-patterns. This flaw allowed an attacker to request a URL that matched a servlet’s url-pattern covered by @ServletSecurity but not by the web.xml constraint, thereby bypassing the intended access control enforcement. The weakness is classified as CWE-863: Role-Based Access Control Weakness.

The vulnerability affects all deployments of Eclipse Jetty that incorporate jetty-annotations or jetty-eeN-annotations across various Jetty releases. Exact affected version ranges are not specified in the available data, so any Jetty installation using these annotation modules should be considered at risk until a vendor patch is applied.

The CVSS score of 8.8 indicates critical severity, while an EPSS score of less than 1% shows that exploitation probability is currently very low. The vulnerability is not listed in the CISA KEV catalog, reducing the likelihood of known public exploits. Attackers would need to exploit the servlet deployment by requesting specific URL patterns that trigger the misapplied constraints, making the attack vector primarily web-based and dependent on the presence of mismatched @ServletSecurity and web.xml configurations.