CVE-2025-11143: Input Validation
The Jetty URI parser has some key differences compared to other common parsers when evaluating invalid or unusual URIs. Specifically:
Invalid Scheme | URI | Jetty | uri-js (nodejs) | node-url(nodejs) | |---|---|---| --- | | https>://vulndetector.com/path | scheme=http>| scheme=https | invalid URI |
Improper IPv4 mapped IPv6
| URI | Jetty | System.Uri(CSharp) | curl(C) | |---|---|---| --- | | http://[0:0:0:0:0:ffff:127.0.0.1] | invalid | host=[::ffff:127.0.0.1] | host=[::ffff:127.0.0.1] | | http://[::ffff:255.255.0.0] | invalid | host=[::ffff:255.255.0.0] | host=[::ffff:255.255.0.0] |
Incorrect IPv6 delimeter priority
| URI | Jetty | urllib3(python) | furl(python) | Spring | chromium | |---|---|---| --- |---|---| | http://[normal.com@]vulndetector.com/ | host=[normal.com@] | invalid | invalid | | | | http://normal.com[user@vulndetector].com/ | host=[noirmal.com@vulndetector | | | host=normal.com | invalid | | http://normal.com[@]vulndetector.com/ | host=normal.com[@] | | | host=normal.com | invalid |
Incorrect delimeter priority
| URI | Jetty | urllib3(python) | jersey | |---|---|---| --- | | http://normal.com/#@vulndetector.com | host=vulndetector.com | host=normal.com | host=normal.com | | http://normal.com/?@vulndetector.com | host=vulndetector.com | host=normal.com | host=normal.com |
Impact Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
Patches Patched in Supported Open Source versions. 12.1.5 - Supported and available on Maven Central 12.0.31 - Supported and available on Maven Central 11.0.x - EOL Release, patches available on tuxcare and herodevs 10.0.x - EOL Release, patches available on tuxcare and herodevs 9.4.x - EOL Release, patches available on tuxcare and herodevs
Workarounds None
Resources
+ Java Eclipse Jetty Report Incorrect Parsing Priority of the IPv6 Hostname Delimeter.pdf + Java Eclipse Jetty Report The Parsing Priority of the Delimiter.pdf + Java Eclipse Jetty Report Parsing Difference Due to Deformed Scheme.pdf + Java Eclipse Jetty Report Improper IPv4-mapped IPv6 Parsing.pdf
Other sources
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.eclipse.jetty:jetty-httpto a version that resolves this vulnerability.Fixed in 12.1.5 - Upgrade
Upgrade
maven/org.eclipse.jetty:jetty-httpto a version that resolves this vulnerability.Fixed in 12.0.31
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11143?
CVE-2025-11143 has a severity rating that depends on the specific context and impact on affected applications.
How do I fix CVE-2025-11143?
To fix CVE-2025-11143, you should upgrade to Jetty version 12.1.5 or 12.0.31 as appropriate for your installation.
Which versions of Jetty are affected by CVE-2025-11143?
CVE-2025-11143 affects Jetty versions ranging from 9.4.0 to 12.1.4.
What issues does CVE-2025-11143 introduce in Jetty?
CVE-2025-11143 introduces inconsistencies in URI parsing, particularly with invalid schemes compared to other parsers.
Is there a workaround for CVE-2025-11143?
Currently, the recommended action for CVE-2025-11143 is to apply the appropriate version upgrade rather than relying on a specific workaround.