CVE-2025-11143
published 2026-03-05CVE-2025-11143: The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using…
PriorityP433medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.16%
5.5th percentile
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jetty12 | < jetty12 12.0.32-1 (forky) | jetty12 12.0.32-1 (forky) |
| debian | jetty9 | < jetty12 12.0.32-1 (forky) | jetty12 12.0.32-1 (forky) |
| eclipse | jetty | 10.0.0 – 10.0.26 | — |
| eclipse | jetty | 11.0.0 – 11.0.26 | — |
| eclipse | jetty | >= 12.0.0 < 12.0.31 | 12.0.31 |
| eclipse | jetty | >= 12.1.0 < 12.1.5 | 12.1.5 |
| eclipse | jetty | 9.4.0 – 9.4.58 | — |
| eclipse_foundation | eclipse_jetty | 10.0.0 – 10.0.26 | — |
| eclipse_foundation | eclipse_jetty | 11.0.0 – 11.0.26 | — |
| eclipse_foundation | eclipse_jetty | 12.0.0 – 12.0.30 | — |
| eclipse_foundation | eclipse_jetty | 12.1.0 – 12.1.4 | — |
| eclipse_foundation | eclipse_jetty | 9.4.0 – 9.4.58 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
osv6.5MEDIUM
vendor_debian3.7LOW
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
org.eclipse.jetty:jetty-http has different parsing of invalid URIs
osv·2026-03-05
CVE-2025-11143 [LOW] org.eclipse.jetty:jetty-http has different parsing of invalid URIs
org.eclipse.jetty:jetty-http has different parsing of invalid URIs
The Jetty URI parser has some key differences compared to other common parsers when evaluating invalid or unusual URIs. Specifically:
#### Invalid Scheme
| URI | Jetty | uri-js (nodejs) | node-url(nodejs) |
|---|---|---| --- |
| `https>://vulndetector.com/path` | scheme=`http>`| scheme=`https` | invalid URI |
#### Improper IPv4 mapped IPv6
| URI | Jetty | System.Uri(CSharp) | curl(C) |
|---|---|---| --- |
| `http://[0:0:0:0:0:ffff:127.0.0.1]` | invalid | host=`[::ffff:127.0.0.1]` | host=`[::ffff:127.0.0.1]` |
| `http://[::ffff:255.255.0.0]` | invalid | host=`[::ffff:255.255.0.0]` | host=`[::ffff:255.255.0.0]` |
#### Incorrect IPv6 delimeter priority
| URI | Jetty | urllib3(python) | furl(python) | Spring | chromium |
GHSA
org.eclipse.jetty:jetty-http has different parsing of invalid URIs
ghsa·2026-03-05
CVE-2025-11143 [LOW] CWE-20 org.eclipse.jetty:jetty-http has different parsing of invalid URIs
org.eclipse.jetty:jetty-http has different parsing of invalid URIs
The Jetty URI parser has some key differences compared to other common parsers when evaluating invalid or unusual URIs. Specifically:
#### Invalid Scheme
| URI | Jetty | uri-js (nodejs) | node-url(nodejs) |
|---|---|---| --- |
| `https>://vulndetector.com/path` | scheme=`http>`| scheme=`https` | invalid URI |
#### Improper IPv4 mapped IPv6
| URI | Jetty | System.Uri(CSharp) | curl(C) |
|---|---|---| --- |
| `http://[0:0:0:0:0:ffff:127.0.0.1]` | invalid | host=`[::ffff:127.0.0.1]` | host=`[::ffff:127.0.0.1]` |
| `http://[::ffff:255.255.0.0]` | invalid | host=`[::ffff:255.255.0.0]` | host=`[::ffff:255.255.0.0]` |
#### Incorrect IPv6 delimeter priority
| URI | Jetty | urllib3(python) | furl(python) | Spring | chromium |
OSV
CVE-2025-11143: The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs
osv·2026-03-05·CVSS 6.5
CVE-2025-11143 [MEDIUM] CVE-2025-11143: The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
Red Hat
org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing
vendor_redhat·2026-03-05·CVSS 3.7
CVE-2025-11143 [LOW] CWE-444 org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing
org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
A flaw was found in org.eclipse.jetty. The Jetty URI parser handles invalid or unusual Uniform Resource Identifiers (URIs) differently compared to other common parsers. This discrepancy, known as differential parsing, can lead to security bypasses in systems that use multiple components to pro
Debian
CVE-2025-11143: jetty12 - The Jetty URI parser has some key differences to other common parsers when evalu...
vendor_debian·2025·CVSS 3.7
CVE-2025-11143 [LOW] CVE-2025-11143: jetty12 - The Jetty URI parser has some key differences to other common parsers when evalu...
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
Scope: local
forky: resolved (fixed in 12.0.32-1)
sid: resolved (fixed in 12.0.32-1)
trixie: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-68161 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2025-68161 [MEDIUM] CVE-2025-68161 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68161 :
Apache Solr vulnerability analysis and mitigation
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
The attacker is able to intercept or redirect network traffic between the client and the log receiver.
The attacker can present a server certificate is
Wiz
CVE-2025-11143 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.7
CVE-2025-11143 [LOW] CVE-2025-11143 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-11143 :
Java vulnerability analysis and mitigation
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
Source : NVD
## 6.5
Score
Published March 5, 2026
Severity MEDIUM
CNA Score 3.7
Affected Technologies
Java
Jenkins
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 27.9
Exploitation Probability (EPSS) 0.1
Affected packages
Wiz
CVE-2025-22234 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.7
CVE-2025-22234 [LOW] CVE-2025-22234 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-22234 :
Jenkins vulnerability analysis and mitigation
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.
Source : NVD
## 5.3
Score
Published January 22, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Jenkins
Spring Security
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 1.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
org.springframework.security:spring-security-core
jenkins
Sources
NVD
Maven Severity MEDIUM Has Fix Ad
Bugzilla
CVE-2025-11143 org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing
bugzilla·2026-03-05·CVSS 3.7
CVE-2025-11143 [LOW] CVE-2025-11143 org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing
CVE-2025-11143 org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
2026-03-05
Published