Skip to content
Fencer Intel
low 3.7

CVE-2025-11143 json

org.eclipse.jetty:jetty-http has different parsing of invalid URIs

published 8mo ago modified 2mo ago also EUVD-2025-208311 , GHSA-wjpw-4j6x-6rwh

cvss
3.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.

Patch / fix

  • maven org.eclipse.jetty:jetty-http 12.0.31, 12.1.5
  • eclipse jetty 12.0.31, 12.1.5
  • org.eclipse.jetty jetty-http 12.0.31, 12.1.5
  • jetty12 Debian 14 12.0.32-1

debian advisories DEBIAN-CVE-2025-11143

  • jetty-minimal SLE Module for Package Hub 15 SP7, SLE Module for Development Tools 15 SP7, openSUSE Leap 15.6 9.4.58-150200.3.37.1
  • jetty-websocket openSUSE Leap 15.6 9.4.58-150200.3.37.1

suse advisories SUSE-SU-2026:1461-1

  • jetty-minimal openSUSE Tumbleweed 9.4.58-3.1

opensuse advisories openSUSE-SU-2026:10300-1

Is CVE-2025-11143 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-11143 updated cvss 3.7

org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing

  • Red Hat OpenShift Developer Tools and Services jenkins, ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-rhel9
    affected: no fix planned “Out of support scope”
  • Red Hat AMQ Broker 7 jetty-http Red Hat build of Apache Camel - HawtIO 4 jetty-http
    affected: no fix available “Fix deferred”
  • Red Hat build of Apache Camel 4 for Quarkus 3 jetty-http
    affected: no fix planned “Out of support scope”
  • Red Hat build of Apache Camel for Spring Boot 4 jetty-http Red Hat build of Apicurio Registry 2 jetty-http Red Hat build of Apicurio Registry 3 jetty-http Red Hat build of Debezium 2 jetty-http Red Hat build of Debezium 3 jetty-http
    affected: no fix available “Fix deferred”
  • Red Hat Data Grid 8 jetty-http
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 jmc
    affected: no fix available “Fix deferred”
  • Red Hat Fuse 7 jetty-http, jetty-http-spi Red Hat JBoss Enterprise Application Platform 7 jetty-http, jetty-http-spi
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform 8 jetty-http, jetty-http-spi
    affected: no fix available “Fix deferred”
show 8 more
  • Red Hat JBoss Enterprise Application Platform Expansion Pack jetty-http, jetty-http-spi
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat JBoss Web Server 6 jetty-http Red Hat OpenShift Dev Spaces devspaces/openvsx-rhel9, devspaces/pluginregistry-rhel9
    affected: no fix available “Fix deferred”
  • Red Hat Process Automation 7 jetty-http
    affected: no fix planned “Out of support scope”
  • Red Hat Satellite 6 puppetserver
    affected: no fix available “Fix deferred”
  • Red Hat Single Sign-On 7 jetty-http
    affected: no fix planned “Out of support scope”
  • Red Hat streams for Apache Kafka 2 jetty-http Red Hat streams for Apache Kafka 3 jetty-http
    affected: no fix available “Fix deferred”
  • Red Hat Offline Knowledge Portal 1.2.13 offline-knowledge-portal/rhokp-rhel9 1779996999
    fixed: vendor fix RHSA-2026:21773
  • Red Hat JBoss Enterprise Application Platform 8 jetty-http-tools Red Hat JBoss Enterprise Application Platform Expansion Pack jetty-http-tools
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
8mo ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
GitHub 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.eclipse.jetty:jetty-http
>=9.4.0, <=9.4.58
>=10.0.0, <=10.0.26
>=11.0.0, <=11.0.26
>=12.0.0, <12.0.31
>=12.1.0, <12.1.5
12.0.31
12.1.5

Affected products

  • Eclipse Foundation Eclipse Jetty

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.