CVE-2025-11143
Fixed in a distro release EPSS <1%CVSS 3.7
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
Products: Eclipse Foundation Eclipse Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty:jetty-http | no fix |
| Maven | org.eclipse.jetty:jetty-http | 12.0.31 |
| Maven | org.eclipse.jetty:jetty-http | 12.1.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | akhq | 0.26.0-r10 |
| Chainguard | apache-activemq-6.1 | no fix |
| Chainguard | apache-activemq-6.2 | no fix |
| Chainguard | apache-activemq-fips-6.1 | no fix |
| Chainguard | apache-activemq-fips-6.2 | no fix |
| Chainguard | apache-hop | 2.17.0-r3 |
| Chainguard | apache-hop-fips | 2.17.0-r3 |
| Chainguard | apache-polaris | no fix |
| Chainguard | apache-polaris-fips | no fix |
| Chainguard | apache-tika-2.9 | no fix |
| Chainguard | apache-tika-3.0 | 3.0.0-r31 |
| Chainguard | apache-tika-3.1 | 3.1.0-r38 |
| Chainguard | apache-tika-3.2 | 3.2.3-r18 |
| Chainguard | apache-tika-3.2-compat | no fix |
| Chainguard | apache-tika-3.3 | 3.3.2-r2 |
| Chainguard | apache-tika-fips-2.9 | no fix |
| Chainguard | apache-tika-fips-3.0 | 3.0.0-r13 |
| Chainguard | apache-tika-fips-3.1 | 3.1.0-r15 |
| Chainguard | apache-tika-fips-3.2 | 3.2.3-r13 |
| Chainguard | apache-tika-fips-3.3 | 3.3.2-r4 |
| Chainguard | automq | no fix |
| Chainguard | automq | 1.7.4-r1 |
| Chainguard | automq-fips | 1.7.4-r1 |
| Chainguard | automq-fips | no fix |
| Chainguard | cassandra-reaper | 5.0.0-r0 |
| Chainguard | celeborn-0.5 | 0.5.4-r26 |
| Chainguard | celeborn-0.5 | no fix |
| Chainguard | celeborn-0.6 | no fix |
| Chainguard | celeborn-0.7 | no fix |
| Chainguard | cloudwatch-exporter | 0.17.0-r0 |
| Chainguard | cloudwatch-exporter | 0.18.0-r5 |
| Chainguard | confluent-kafka | 8.3.0.373-r0 |
| Chainguard | confluent-kafka | 8.3.0.375-r0 |
| Chainguard | confluent-kafka-jre-bcfips | 8.3.0.411-r0 |
| Chainguard | cruise-control | 2.5.146-r1 |
| Chainguard | cruise-control-fips | 2.5.146-r2 |
| Chainguard | cruise-control-fips-jars | no fix |
| Chainguard | cruise-control-jars | no fix |
| Chainguard | data-prepper | 2.16.0-r2 |
| Chainguard | dependency-track | 4.14.0-r0 |
| Chainguard | dependency-track-apiserver | 4.14.0-r0 |
| Chainguard | dependency-track-bundled | 4.14.0-r0 |
| Chainguard | druid | 37.0.0-r14 |
| Chainguard | druid | no fix |
| Chainguard | druid | 36.0.0-r7 |
| Chainguard | druid | 37.0.0-r56 |
| Chainguard | hadoop-client-modules | no fix |
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | 3.5.0-r12 |
| Chainguard | jenkins-2.516-openjdk-17 | no fix |
| Chainguard | jenkins-2.516-openjdk-21 | no fix |
| Chainguard | jenkins-2.528-openjdk-17 | no fix |
| Chainguard | jenkins-2.528-openjdk-21 | no fix |
| Chainguard | kafka-3.7 | no fix |
| Chainguard | kafka-3.8 | no fix |
| Chainguard | kafka-3.9 | no fix |
| Chainguard | kafka-4.0 | 4.0.2-r0 |
| Chainguard | kafka-4.0 | 4.0.2-r1 |
| Chainguard | kafka-4.1 | 4.1.2-r1 |
| Chainguard | kafka-4.1 | 4.1.2-r0 |
| Chainguard | kafka-4.2 | 4.2.0-r5 |
| Chainguard | kafka-fips-4.1 | 4.1.2-r0 |
| Chainguard | kafka-fips-4.1 | 4.1.2-r1 |
| Chainguard | kafka-fips-4.2 | 4.2.1-r0 |
| Chainguard | kafka-strimzi-compat | 1.2.0-r5 |
| Chainguard | kafka-strimzi-fips-compat | no fix |
| Chainguard | kafka_exporter-strimzi-compat | 1.2.0-r5 |
| Chainguard | kafka_exporter-strimzi-compat | 1.2.0-r4 |
| Chainguard | kafka_exporter-strimzi-fips-compat | no fix |
| Chainguard | kayenta-2025.0 | no fix |
| Chainguard | kayenta-2025.1 | no fix |
| Chainguard | kayenta-2025.2 | no fix |
| Chainguard | kayenta-2025.4 | no fix |
| Chainguard | kayenta-2026.0 | no fix |
| Chainguard | kayenta-2026.1 | no fix |
| Chainguard | kayenta-2026.2 | no fix |
| Chainguard | kayenta-fips-2025.0 | no fix |
| Chainguard | kayenta-fips-2025.1 | no fix |
| Chainguard | kayenta-fips-2025.2 | no fix |
| Chainguard | kayenta-fips-2025.4 | no fix |
| Chainguard | kayenta-fips-2026.0 | no fix |
| Chainguard | kayenta-fips-2026.1 | no fix |
| Chainguard | kayenta-fips-2026.2 | no fix |
| Chainguard | kayenta-fips-2026.2 | 2026.2.5-r1 |
| Chainguard | neo4j-2025.08 | no fix |
| Chainguard | neo4j-2025.09 | no fix |
| Chainguard | neo4j-2025.10 | no fix |
| Chainguard | neo4j-2025.11 | no fix |
| Chainguard | neo4j-2025.12 | no fix |
| Chainguard | neo4j-2026.01 | no fix |
| Chainguard | neo4j-4.4 | no fix |
| Chainguard | neo4j-5.26 | 5.26.21-r3 |
| Chainguard | pinot | 1.5.0-r0 |
| Chainguard | pinot-fips | 1.5.0-r0 |
| Chainguard | prometheus-jmx-exporter-strimzi-compat | 1.6.0-r0 |
| Chainguard | prometheus-jmx-exporter-strimzi-fips-compat | no fix |
| Chainguard | ranger | no fix |
| Chainguard | reposilite | 3.6.1-r0 |
| Chainguard | reposilite | 3.6.0-r0 |
| Chainguard | solr | 10.0.0-r1 |
| Chainguard | solr-9 | no fix |
| Chainguard | solr-9-full | no fix |
| Chainguard | solr-9-iamguarded-compat | no fix |
| Chainguard | solr-fips-9 | no fix |
| Chainguard | solr-fips-9-full | no fix |
| Chainguard | solr-fips-9-iamguarded-compat | no fix |
| Chainguard | spark-3.5-scala-2.12 | no fix |
| Chainguard | spark-3.5-scala-2.12 | 3.5.9-r2 |
| Chainguard | spark-3.5-scala-2.13 | 3.5.9-r2 |
| Chainguard | spark-3.5-scala-2.13 | no fix |
| Chainguard | spark-4.0-scala-2.13 | 4.0.3-r2 |
| Chainguard | spark-4.0-scala-2.13 | no fix |
| Chainguard | spark-4.1-scala-2.13 | 4.1.2-r5 |
| Chainguard | spark-4.1-scala-2.13 | no fix |
| Chainguard | spark-fips-3.5-scala-2.12 | 3.5.8-r0 |
| Chainguard | spark-fips-3.5-scala-2.13 | 3.5.8-r0 |
| Chainguard | spark-fips-4.1-scala-2.13 | 4.1.2-r10 |
| Chainguard | spark-fips-4.1-scala-2.13 | no fix |
| Chainguard | spark-kubernetes-operator | 0.9.0-r0 |
| Chainguard | spark-kubernetes-operator-fips | 0.7.0-r1 |
| Chainguard | strimzi-kafka-operator | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-cluster-operator | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-cluster-operator | no fix |
| Chainguard | strimzi-kafka-operator-cluster-operator | 1.0.0-r8 |
| Chainguard | strimzi-kafka-operator-cluster-operator | 1.2.0-r4 |
| Chainguard | strimzi-kafka-operator-fips | no fix |
| Chainguard | strimzi-kafka-operator-fips-cluster-operator | no fix |
| Chainguard | strimzi-kafka-operator-fips-kafka-agent | no fix |
| Chainguard | strimzi-kafka-operator-fips-kafka-base | no fix |
| Chainguard | strimzi-kafka-operator-fips-kafka-init | 1.2.0-r3 |
| Chainguard | strimzi-kafka-operator-fips-kafka-init | no fix |
| Chainguard | strimzi-kafka-operator-fips-kafka-thirdparty-libs | no fix |
| Chainguard | strimzi-kafka-operator-fips-kafka-thirdparty-libs-cc | no fix |
| Chainguard | strimzi-kafka-operator-fips-kafka-thirdparty-libs-cc | 1.0.0-r1 |
| Chainguard | strimzi-kafka-operator-fips-topic-operator | no fix |
| Chainguard | strimzi-kafka-operator-fips-tracing-agent | no fix |
| Chainguard | strimzi-kafka-operator-fips-user-operator | no fix |
| Chainguard | strimzi-kafka-operator-kafka-agent | no fix |
| Chainguard | strimzi-kafka-operator-kafka-agent | 1.0.0-r8 |
| Chainguard | strimzi-kafka-operator-kafka-agent | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-kafka-base | no fix |
| Chainguard | strimzi-kafka-operator-kafka-base | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-kafka-init | 1.0.0-r8 |
| Chainguard | strimzi-kafka-operator-kafka-init | 1.2.0-r4 |
| Chainguard | strimzi-kafka-operator-kafka-init | no fix |
| Chainguard | strimzi-kafka-operator-kafka-init | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-kafka-thirdparty-libs | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-kafka-thirdparty-libs-cc | no fix |
| Chainguard | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 1.0.0-r8 |
| Chainguard | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-topic-operator | 1.2.0-r4 |
| Chainguard | strimzi-kafka-operator-topic-operator | 1.0.0-r8 |
| Chainguard | strimzi-kafka-operator-topic-operator | no fix |
| Chainguard | strimzi-kafka-operator-topic-operator | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-tracing-agent | no fix |
| Chainguard | strimzi-kafka-operator-tracing-agent | 1.0.0-r8 |
| Chainguard | strimzi-kafka-operator-tracing-agent | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-user-operator | no fix |
| Chainguard | strimzi-kafka-operator-user-operator | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-user-operator | 1.0.0-r8 |
| Chainguard | tez | no fix |
| Chainguard | trino | no fix |
| Chainguard | trino-plugin-bigquery | 483-r7 |
| Chainguard | trino-plugin-opensearch | no fix |
| Chainguard | trino-plugin-oracle | 483-r7 |
| Chainguard | trino-plugin-ranger | 481-r9 |
| Chainguard | trino-plugin-teradata-functions | no fix |
| Chainguard | wso2is | 7.3.0-r0 |
| Chainguard | zaproxy | 2.17.0-r12 |
| Chainguard | zookeeper-3.8 | 3.8.6-r1 |
| Chainguard | zookeeper-3.9 | 3.9.5-r0 |
| Chainguard | zookeeper-fips-3.8 | 3.8.6-r2 |
| Chainguard | zookeeper-fips-3.9 | 3.9.5-r0 |
| Debian 12 | jetty9 | no fix |
| Debian 13 | jetty12 | no fix |
| Debian 13 | jetty9 | no fix |
| Debian 14 | jetty12 | 12.0.32-1 |
| Debian 14 | jetty9 | no fix |
| SUSE Linux Enterprise Module for Development Tools 15 SP7 | jetty-minimal | 9.4.58-150200.3.37.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | jetty-minimal | 9.4.58-150200.3.37.1 |
| Ubuntu 16.04 LTS | jetty9 | no fix |
| Ubuntu 18.04 LTS | jetty9 | no fix |
| Ubuntu 20.04 LTS | jetty9 | no fix |
| Ubuntu 22.04 LTS | jetty9 | no fix |
| Ubuntu 24.04 LTS | jetty9 | no fix |
| Ubuntu 25.10 | jetty9 | no fix |
| Ubuntu 26.04 LTS | jetty12 | no fix |
| Ubuntu 26.04 LTS | jetty9 | no fix |
| Ubuntu 26.10 | jetty12 | no fix |
| Ubuntu 26.10 | jetty9 | no fix |
| Wolfi | akhq | 0.26.0-r10 |
| Wolfi | apache-tika-3.1 | 3.1.0-r38 |
| Wolfi | apache-tika-3.2 | 3.2.3-r18 |
| Wolfi | apache-tika-3.2-compat | no fix |
| Wolfi | apache-tika-3.3 | 3.3.2-r2 |
| Wolfi | cassandra-reaper | 5.0.0-r0 |
| Wolfi | celeborn-0.6 | no fix |
| Wolfi | cloudwatch-exporter | 0.18.0-r5 |
| Wolfi | cloudwatch-exporter | 0.17.0-r0 |
| Wolfi | confluent-kafka | 8.3.0.373-r0 |
| Wolfi | confluent-kafka | 8.3.0.375-r0 |
| Wolfi | dependency-track | 4.14.0-r0 |
| Wolfi | dependency-track-bundled | 4.14.0-r0 |
| Wolfi | druid | no fix |
| Wolfi | druid | 37.0.0-r14 |
| Wolfi | druid | 36.0.0-r7 |
| Wolfi | druid | 37.0.0-r56 |
| Wolfi | kafka-4.1 | 4.1.2-r0 |
| Wolfi | kafka-4.1 | 4.1.2-r1 |
| Wolfi | kafka-4.2 | 4.2.0-r5 |
| Wolfi | kafka-strimzi-compat | 1.2.0-r5 |
| Wolfi | kafka_exporter-strimzi-compat | 1.2.0-r5 |
| Wolfi | kafka_exporter-strimzi-compat | 1.2.0-r4 |
| Wolfi | neo4j-2025.10 | no fix |
| Wolfi | neo4j-2025.12 | no fix |
| Wolfi | neo4j-2026.01 | no fix |
| Wolfi | prometheus-jmx-exporter-strimzi-compat | 1.6.0-r0 |
| Wolfi | solr | 10.0.0-r1 |
| Wolfi | spark-4.0-scala-2.13 | no fix |
| Wolfi | spark-4.0-scala-2.13 | 4.0.3-r2 |
| Wolfi | spark-4.1-scala-2.13 | no fix |
| Wolfi | spark-4.1-scala-2.13 | 4.1.2-r5 |
| Wolfi | strimzi-kafka-operator | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-cluster-operator | no fix |
| Wolfi | strimzi-kafka-operator-cluster-operator | 1.0.0-r8 |
| Wolfi | strimzi-kafka-operator-cluster-operator | 1.2.0-r4 |
| Wolfi | strimzi-kafka-operator-cluster-operator | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-agent | 1.0.0-r8 |
| Wolfi | strimzi-kafka-operator-kafka-agent | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-agent | no fix |
| Wolfi | strimzi-kafka-operator-kafka-base | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-base | no fix |
| Wolfi | strimzi-kafka-operator-kafka-init | 1.2.0-r4 |
| Wolfi | strimzi-kafka-operator-kafka-init | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-init | no fix |
| Wolfi | strimzi-kafka-operator-kafka-init | 1.0.0-r8 |
| Wolfi | strimzi-kafka-operator-kafka-thirdparty-libs | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-thirdparty-libs-cc | no fix |
| Wolfi | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 1.0.0-r8 |
| Wolfi | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-topic-operator | 1.0.0-r8 |
| Wolfi | strimzi-kafka-operator-topic-operator | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-topic-operator | 1.2.0-r4 |
| Wolfi | strimzi-kafka-operator-topic-operator | no fix |
| Wolfi | strimzi-kafka-operator-tracing-agent | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-tracing-agent | no fix |
| Wolfi | strimzi-kafka-operator-tracing-agent | 1.0.0-r8 |
| Wolfi | strimzi-kafka-operator-user-operator | no fix |
| Wolfi | strimzi-kafka-operator-user-operator | 1.0.0-r8 |
| Wolfi | strimzi-kafka-operator-user-operator | 1.2.0-r5 |
| Wolfi | tez | no fix |
| Wolfi | trino | no fix |
| Wolfi | trino-plugin-bigquery | 483-r7 |
| Wolfi | trino-plugin-opensearch | no fix |
| Wolfi | trino-plugin-oracle | 483-r7 |
| Wolfi | trino-plugin-ranger | 481-r9 |
| Wolfi | trino-plugin-teradata-functions | no fix |
| Wolfi | zookeeper-3.9 | 3.9.5-r0 |
| openSUSE Leap 15.6 | jetty-minimal | 9.4.58-150200.3.37.1 |
| openSUSE Leap 15.6 | jetty-websocket | 9.4.58-150200.3.37.1 |
| openSUSE Tumbleweed | jetty-minimal | 9.4.58-3.1 |