Eclipse Jetty Security Advisory - CVE-2025-11143
Severity: Low (CVSS 3.1)
Affected component: org.eclipse.jetty:jetty-http
Affected versions:
- 9.4.0 through 9.4.58
- 10.0.0 through 10.0.26
- 11.0.0 through 11.0.26
- 12.0.0 through 12.0.30
- 12.1.0 through 12.1.4
Fix available (supported open source versions):
- 12.0.31 (available on Maven Central)
- 12.1.5 (available on Maven Central)
- 9.4.x / 10.0.x / 11.0.x - EOL releases, patches available, see details
https://webtide.com/end-of-life/Description:
The Jetty URI parser has key differences to other common parsers when evaluating invalid or unusual URIs. These differences include handling of invalid schemes, improper IPv4-mapped IPv6 addresses,
incorrect IPv6 delimiter priority, and incorrect delimiter priority for # and ? characters relative to @.
Differential parsing of URIs in systems using multiple components may result in security bypass. For example, a component that enforces a blocklist may interpret URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
Weakness: CWE-20 (Improper Input Validation)
Workaround: None.
Credit:
https://github.com/zer0yu,
https://github.com/P3ngu1nW,
https://github.com/9vvert
The Eclipse Jetty Team
