Critical Security Update for Jetty9: Addressing CVE-2025-5115
Summary
DLA-4299-1: jetty9 - security update. Affects jetty9 versions < 9.4.57-0+deb11u3. Fixed in 9.4.57-0+deb11u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jetty9 is a widely-used Java-based web server and servlet container that provides a robust platform for running web applications. Known for its lightweight architecture and scalability, Jetty9 is often integrated into various Java applications. However, it has recently been identified as vulnerable to a security issue that could potentially compromise the integrity and availability of applications relying on it.
Vulnerability Detail
The vulnerability identified as CVE-2025-5115 affects Jetty9, allowing unauthorized access to sensitive data or services. This issue arises from improper handling of certain requests, which could lead to information disclosure or denial of service. Attackers exploiting this vulnerability may gain access to confidential information or disrupt service availability, posing significant risks to applications and their users.
How To Fix
Minimum fixed version
9.4.57-0+deb11u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jetty9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider restricting access to the Jetty9 server by implementing firewall rules or modifying server configurations to limit exposure to potentially malicious requests. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
In summary, the vulnerability CVE-2025-5115 poses a significant threat to Jetty9 users, potentially leading to unauthorized access and service disruptions. It is crucial to update to the latest patched version to ensure the security and integrity of your applications. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for jetty9 →
FAQ
CVE-2025-5115 is a security vulnerability in Jetty9 that can lead to unauthorized access and potential data breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability could lead to data leaks, unauthorized access, and service disruptions, impacting your application's reliability and user trust.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Users of Jetty9 should immediately update to the patched version 9.4.57-0+deb11u3 to mitigate the risks associated with CVE-2025-5115.
Related vulnerabilities
Recent vulnerabilities recorded for jetty9.
