CVE-2025-11143
1 advisory.
Maven/org.eclipse.jetty:jetty-http CVE-2025-11143: low 3.7
org.eclipse.jetty:jetty-http has different parsing of invalid URIs
Action: Upgrade org.eclipse.jetty:jetty-http to 12.0.31 (12.0.x) or 12.1.5 (12.1.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.4.0 | - | 9.4.58 |
| 10.0.0 | - | 10.0.26 |
| 11.0.0 | - | 11.0.26 |
| 12.0.0 | 12.0.31 | - |
| 12.1.0 | 12.1.5 | - |
Fixed versions
| 12.0.31 | 12.1.5 |
Sources
- osv: GHSA-wjpw-4j6x-6rwh
- https://github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwh
- https://nvd.nist.gov/vuln/detail/CVE-2025-11143
- https://github.com/jetty/jetty.project
- https://github.com/user-attachments/files/22222625/Java.Eclipse.Jetty.Report_.Incorrect.Parsing.Priority.of.the.IPv6.Hostname.Delimeter.pdf
- https://github.com/user-attachments/files/22222626/Java.Eclipse.Jetty.Report_.The.Parsing.Priority.of.the.Delimiter.pdf
- https://github.com/user-attachments/files/22222627/Java.Eclipse.Jetty.Report_.Parsing.Difference.Due.to.Deformed.Scheme.pdf
- https://github.com/user-attachments/files/22222630/Java.Eclipse.Jetty.Report_.Improper.IPv4-mapped.IPv6.Parsing.pdf
CVE-2025-11143 · published · modified · JSON