Low severity3.7NVD Advisory· Published Mar 5, 2026· Updated Jun 17, 2026

CVE-2025-11143

Description

The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.eclipse.jetty:jetty-httpMaven	>= 9.4.0, <= 9.4.58	—
org.eclipse.jetty:jetty-httpMaven	>= 10.0.0, <= 10.0.26	—
org.eclipse.jetty:jetty-httpMaven	>= 11.0.0, <= 11.0.26	—
org.eclipse.jetty:jetty-httpMaven	>= 12.0.0, < 12.0.31	12.0.31
org.eclipse.jetty:jetty-httpMaven	>= 12.1.0, < 12.1.5	12.1.5

Affected products

Eclipse/Jetty
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Range: >=9.4.0,<=9.4.58
osv-coords67 versions
pkg:apk/chainguard/akhq pkg:apk/chainguard/apache-hop pkg:apk/chainguard/apache-hop-fips pkg:apk/chainguard/cassandra-reaper pkg:apk/chainguard/cloudwatch-exporter pkg:apk/chainguard/confluent-kafka pkg:apk/chainguard/confluent-kafka-jre-bcfips pkg:apk/chainguard/cruise-control pkg:apk/chainguard/cruise-control-fips pkg:apk/chainguard/dependency-track pkg:apk/chainguard/dependency-track-apiserver pkg:apk/chainguard/dependency-track-bundled pkg:apk/chainguard/kafka-4.0 pkg:apk/chainguard/kafka-4.1 pkg:apk/chainguard/kafka-4.2 pkg:apk/chainguard/kafka-fips-4.1 pkg:apk/chainguard/kafka-fips-4.2 pkg:apk/chainguard/neo4j-5.26 pkg:apk/chainguard/pinot pkg:apk/chainguard/pinot-fips pkg:apk/chainguard/reposilite pkg:apk/chainguard/solr pkg:apk/chainguard/spark-fips-3.5-scala-2.12 pkg:apk/chainguard/spark-fips-3.5-scala-2.13 pkg:apk/chainguard/spark-kubernetes-operator pkg:apk/chainguard/spark-kubernetes-operator-fips pkg:apk/chainguard/strimzi-kafka-operator-cluster-operator pkg:apk/chainguard/strimzi-kafka-operator-fips-kafka-thirdparty-libs-cc pkg:apk/chainguard/strimzi-kafka-operator-kafka-agent pkg:apk/chainguard/strimzi-kafka-operator-kafka-init pkg:apk/chainguard/strimzi-kafka-operator-kafka-thirdparty-libs-cc pkg:apk/chainguard/strimzi-kafka-operator-topic-operator pkg:apk/chainguard/strimzi-kafka-operator-tracing-agent pkg:apk/chainguard/strimzi-kafka-operator-user-operator pkg:apk/chainguard/trino-plugin-ranger pkg:apk/chainguard/wso2is pkg:apk/chainguard/zookeeper-3.8 pkg:apk/chainguard/zookeeper-3.9 pkg:apk/chainguard/zookeeper-fips-3.8 pkg:apk/chainguard/zookeeper-fips-3.9 pkg:apk/wolfi/akhq pkg:apk/wolfi/cassandra-reaper pkg:apk/wolfi/cloudwatch-exporter pkg:apk/wolfi/confluent-kafka pkg:apk/wolfi/dependency-track pkg:apk/wolfi/dependency-track-bundled pkg:apk/wolfi/kafka-4.0 pkg:apk/wolfi/kafka-4.1 pkg:apk/wolfi/kafka-4.2 pkg:apk/wolfi/neo4j-5.26 pkg:apk/wolfi/solr pkg:apk/wolfi/strimzi-kafka-operator-cluster-operator pkg:apk/wolfi/strimzi-kafka-operator-kafka-agent pkg:apk/wolfi/strimzi-kafka-operator-kafka-init pkg:apk/wolfi/strimzi-kafka-operator-kafka-thirdparty-libs-cc pkg:apk/wolfi/strimzi-kafka-operator-topic-operator pkg:apk/wolfi/strimzi-kafka-operator-tracing-agent pkg:apk/wolfi/strimzi-kafka-operator-user-operator pkg:apk/wolfi/trino-plugin-ranger pkg:apk/wolfi/zookeeper-3.8 pkg:apk/wolfi/zookeeper-3.9 pkg:maven/org.eclipse.jetty/jetty-http pkg:rpm/opensuse/jetty-minimal&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/jetty-minimal&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/jetty-websocket&distro=openSUSE%20Leap%2015.6 pkg:rpm/suse/jetty-minimal&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7 pkg:rpm/suse/jetty-minimal&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7
< 0.26.0-r10+ 66 more
- (no CPE)range: < 0.26.0-r10
- (no CPE)range: < 2.17.0-r3
- (no CPE)range: < 2.17.0-r3
- (no CPE)range: < 5.0.0-r0
- (no CPE)range: < 0.17.0-r0
- (no CPE)range: < 8.3.0.375-r0
- (no CPE)range: < 8.3.0.411-r0
- (no CPE)range: < 2.5.146-r1
- (no CPE)range: < 2.5.146-r2
- (no CPE)range: < 4.14.0-r0
- (no CPE)range: < 4.14.0-r0
- (no CPE)range: < 4.14.0-r0
- (no CPE)range: < 4.0.2-r1
- (no CPE)range: < 4.1.2-r1
- (no CPE)range: < 4.2.0-r5
- (no CPE)range: < 4.1.2-r1
- (no CPE)range: < 4.2.1-r0
- (no CPE)range: < 5.26.21-r3
- (no CPE)range: < 1.5.0-r0
- (no CPE)range: < 1.5.0-r0
- (no CPE)range: < 3.6.1-r0
- (no CPE)range: < 10.0.0-r1
- (no CPE)range: < 3.5.8-r0
- (no CPE)range: < 3.5.8-r0
- (no CPE)range: < 0.9.0-r0
- (no CPE)range: < 0.7.0-r1
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 1.0.0-r1
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 481-r9
- (no CPE)range: < 7.3.0-r0
- (no CPE)range: < 3.8.6-r1
- (no CPE)range: < 3.9.5-r0
- (no CPE)range: < 3.8.6-r2
- (no CPE)range: < 3.9.5-r0
- (no CPE)range: < 0.26.0-r10
- (no CPE)range: < 5.0.0-r0
- (no CPE)range: < 0.17.0-r0
- (no CPE)range: < 8.3.0.375-r0
- (no CPE)range: < 4.14.0-r0
- (no CPE)range: < 4.14.0-r0
- (no CPE)range: < 4.0.2-r1
- (no CPE)range: < 4.1.2-r1
- (no CPE)range: < 4.2.0-r5
- (no CPE)range: < 5.26.21-r3
- (no CPE)range: < 10.0.0-r1
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 1.0.0-r8
- (no CPE)range: < 481-r9
- (no CPE)range: < 3.8.6-r1
- (no CPE)range: < 3.9.5-r0
- (no CPE)range: >= 9.4.0, <= 9.4.58
- (no CPE)range: < 9.4.58-150200.3.37.1
- (no CPE)range: < 9.4.58-3.1
- (no CPE)range: < 9.4.58-150200.3.37.1
- (no CPE)range: < 9.4.58-150200.3.37.1
- (no CPE)range: < 9.4.58-150200.3.37.1
Eclipse Foundation/Eclipse Jettyv5
Range: 9.4.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-wjpw-4j6x-6rwhghsaADVISORY
github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwhnvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2025-11143ghsaADVISORY

News mentions

No linked articles in our index yet.

Severity

LowCVSS v3.1

3.7/ 10

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected

Source repos: github.com/jetty/jetty.project
github.com/user-attachments/files/22222625/Java.Eclipse.Jetty.Report_.Incorrect.Parsing.Priority.of.the.IPv6.Hostname.Delimeter.pdf
github.com/user-attachments/files/22222626/Java.Eclipse.Jetty.Report_.The.Parsing.Priority.of.the.Delimiter.pdf
github.com/user-attachments/files/22222627/Java.Eclipse.Jetty.Report_.Parsing.Difference.Due.to.Deformed.Scheme.pdf
github.com/user-attachments/files/22222630/Java.Eclipse.Jetty.Report_.Improper.IPv4-mapped.IPv6.Parsing.pdf

EPSS

Probability of exploitation in the next 30 days.

0.16%

VYPR risk score

Composite of severity, exploitation, and reach.

0.24low

cvss	0.240
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-20
Improper Input Validation

CVE ID

CVE-2025-11143

Credits

Z
zer0yu
finder
P
P3ngu1nW
reporter · ghsa
Z
zer0yu
reporter · ghsa