CVE-2025-11143: org.eclipse.jetty:jetty-http URI Parsing Vulnerability
Summary
CVE-2025-11143: org.eclipse.jetty:jetty-http has different parsing of invalid URIs. Affects org.eclipse.jetty:jetty-http across 5 version ranges.
>= 9.4.0, <= 9.4.58
>= 10.0.0, <= 10.0.26
>= 11.0.0, <= 11.0.26
>= 12.0.0, < 12.0.31
>= 12.1.0, < 12.1.5
Fixed in 12.0.31 or 12.1.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.eclipse.jetty:jetty-http is a widely used Java-based HTTP server and client library that provides a robust framework for building web applications. It is known for its scalability, performance, and support for modern web standards. However, it has been identified to have a vulnerability in its URI parsing mechanism, which can lead to inconsistent interpretations of invalid or unusual URIs across different systems.
Vulnerability Detail
The vulnerability arises from Jetty's unique parsing logic for URIs, which differs from other common parsers. This inconsistency can lead to security bypasses, where a component enforcing a blacklist may interpret URIs differently than another component generating a response. For example, Jetty may incorrectly parse a URI with an invalid scheme or improperly handle IPv4-mapped IPv6 addresses, potentially exposing sensitive implementation details.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 12.0.0, < 12.0.3112.0.31 -
>= 12.1.0, < 12.1.512.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. It is advisable to apply the patches as soon as possible.
Conclusion
In summary, CVE-2025-11143 presents a significant risk due to the differential parsing of URIs in org.eclipse.jetty:jetty-http. It is crucial to update to the patched versions to mitigate potential security risks and ensure consistent URI handling across components.
See every vulnerability recorded for org.eclipse.jetty:jetty-http →
FAQ
CVE-2025-11143 is a vulnerability in the org.eclipse.jetty:jetty-http package that affects its URI parsing logic, leading to potential security bypasses.
The vulnerability can lead to inconsistent URI parsing, which may allow attackers to bypass security measures implemented in your application.
Affected versions include 9.4.0 to 9.4.58, 10.0.0 to 10.0.26, 11.0.0 to 11.0.26, and 12.0.0 to 12.0.30.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. You can check your application using the Vulert playground without signup.
The CVSS score for this vulnerability is 3.7, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-http.
