Log in Start free

Vulnerability · Published Mar 5, 2026 · Assigned by eclipse

CVE-2025-11143

Low 3.7

In plain English

A low-severity improper input validation in Eclipse Jetty from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.2%top 92.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13jetty12no fix listedDEBIAN-CVE-2025-11143
Debian:14jetty1212.0.32-1DEBIAN-CVE-2025-11143
Debian:12jetty9no fix listedDEBIAN-CVE-2025-11143
Debian:13jetty9no fix listedDEBIAN-CVE-2025-11143
Debian:14jetty9no fix listedDEBIAN-CVE-2025-11143
Mavenorg.eclipse.jetty:jetty-httpno fix listedGHSA-wjpw-4j6x-6rwh
Mavenorg.eclipse.jetty:jetty-httpno fix listedGHSA-wjpw-4j6x-6rwh
Mavenorg.eclipse.jetty:jetty-httpno fix listedGHSA-wjpw-4j6x-6rwh
Mavenorg.eclipse.jetty:jetty-http12.0.31GHSA-wjpw-4j6x-6rwh
Mavenorg.eclipse.jetty:jetty-http12.1.5GHSA-wjpw-4j6x-6rwh
Ubuntu:26.04:LTSjetty12no fix listedUBUNTU-CVE-2025-11143
Ubuntu:26.10jetty12no fix listedUBUNTU-CVE-2025-11143
Ubuntu:22.04:LTSjetty9no fix listedUBUNTU-CVE-2025-11143
Ubuntu:24.04:LTSjetty9no fix listedUBUNTU-CVE-2025-11143
Ubuntu:25.10jetty9no fix listedUBUNTU-CVE-2025-11143
Ubuntu:26.04:LTSjetty9no fix listedUBUNTU-CVE-2025-11143
Ubuntu:26.10jetty9no fix listedUBUNTU-CVE-2025-11143

Affected products (as reported)

VendorProductVersions
Eclipse Foundation Eclipse Jetty 9.4.0 – through 9.4.5810.0.0 – through 10.0.2611.0.0 – through 11.0.2612.0.0 – through 12.0.3012.1.0 – through 12.1.4

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References