p PatchFirst

CVE-2025-11143

CVE-2025-11143

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.

CVSS 3.7 · Low · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • eclipse jetty

    Versions
    • ≥ 9.4.0, ≤ 9.4.58: Affected (semver)
    • ≥ 10.0.0, ≤ 10.0.26: Affected (semver)
    • ≥ 11.0.0, ≤ 11.0.26: Affected (semver)
    • ≥ 12.0.0, ≤ 12.0.30: Affected (semver)
    • ≥ 12.1.0, ≤ 12.1.4: Affected (semver)

    No fix published

  • jetty12 Debian:13

    Versions
    • 12.0.17-3
    • 12.0.17-3.1
    • 12.0.17-3.1~deb13u1
    • 12.0.32-1
    • 12.0.32-2
    • 12.0.33-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty12 Debian:14

    Versions
    • 12.0.17-3
    • 12.0.17-3.1
    • 12.0.17-3.1~deb13u1
    Affected ranges
    • ECOSYSTEM: < 12.0.32-1

    Update to 12.0.32-1

  • jetty9 Debian:12

    Versions
    • 9.4.50-4
    • 9.4.50-4+deb12u1
    • 9.4.50-4+deb12u2
    • 9.4.50-4+deb12u3
    • 9.4.51-1
    • 9.4.51-2
    • 9.4.52-1
    • 9.4.53-1
    • 9.4.54-1
    • 9.4.55-1
    • 9.4.56-1
    • 9.4.57-0+deb12u1
    • 9.4.57-1
    • 9.4.57-1.1
    • 9.4.57-1.1~deb12u1
    • 9.4.57-1.1~deb13u1
    • 9.4.58-1
    • 9.4.58-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Debian:13

    Versions
    • 9.4.57-1
    • 9.4.57-1.1
    • 9.4.57-1.1~deb12u1
    • 9.4.57-1.1~deb13u1
    • 9.4.58-1
    • 9.4.58-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Debian:14

    Versions
    • 9.4.57-1
    • 9.4.57-1.1
    • 9.4.57-1.1~deb12u1
    • 9.4.57-1.1~deb13u1
    • 9.4.58-1
    • 9.4.58-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:16.04:LTS

    Versions
    • 9.2.14-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:18.04:LTS

    Versions
    • 9.2.22-2
    • 9.2.22-3
    • 9.2.23-1
    • 9.4.15-1~18.04.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:20.04:LTS

    Versions
    • 9.4.18-2build2
    • 9.4.26-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:22.04:LTS

    Versions
    • 9.4.39-3
    • 9.4.44-2
    • 9.4.44-3
    • 9.4.44-4
    • 9.4.45-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:24.04:LTS

    Versions
    • 9.4.51-2
    • 9.4.53-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:25.10

    Versions
    • 9.4.56-1
    • 9.4.57-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty12 Ubuntu:26.10

    Versions
    • 12.0.32-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:26.10

    Versions
    • 9.4.58-1
    • 9.4.58-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty12 Ubuntu:26.04:LTS

    Versions
    • 12.0.17-3.1
    • 12.0.32-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:26.04:LTS

    Versions
    • 9.4.57-1
    • 9.4.57-1.1
    • 9.4.58-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →