org.eclipse.jetty:jetty-http has different parsing of invalid URIs

🗓️ 05 Mar 2026 21:41:25Reported by GitHub Advisory DatabaseType

Jetty URI parser differs from others on invalid schemes and IPv4 mapped IPv6, risking bypass.

Reporter	Title	Published	Views	Family All 109
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager - Multiple CVEs addressed related to SOLR and its dependencies (such as Jetty) affecting ODM-9.0.0 and older versions	17 Jun 202605:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by CVE-2025-11143	15 Jun 202606:17	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Input Validation (CVE-2025-11143)	16 Jun 202617:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to issues in Jetty	3 Jun 202615:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for Unix is impacted by Improper Input Validation vulnerability due to jetty-http.	29 May 202614:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2026-1605, CVE-2026-29063, CVE-2025-11143, CVE-2026-2332, CVE-2025-15599, CVE-2026-0540)	27 Apr 202615:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in jetty-http (CVE-2025-11143)	28 Apr 202614:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operations Analytics - Log Analysis is affected by denial of service (DoS), server-side request forgery (SSRF) protections, leak or corrupt request data, and security by-pass due to the use of Eclipse Jetty	6 Apr 202617:40	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Eclipse Jetty	11 Jun 202616:23	–	ibm
IBM Security Bulletins	Security Bulletin:Jetty URI Parser Differences and Potential Security Implications	4 May 202612:41	–	ibm

Vulners

Node

org.eclipse.jetty jetty-httpRange12.1.0–12.1.4maven

org.eclipse.jetty jetty-httpRange12.0.0–12.0.30maven

org.eclipse.jetty jetty-httpRange11.0.0–11.0.26maven

org.eclipse.jetty jetty-httpRange10.0.0–10.0.26maven

org.eclipse.jetty jetty-httpRange9.4.0–9.4.58maven

Source	Link
github	www.github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwh
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-11143
github	www.github.com/user-attachments/files/22222625/Java.Eclipse.Jetty.Report_.Incorrect.Parsing.Priority.of.the.IPv6.Hostname.Delimeter.pdf
github	www.github.com/user-attachments/files/22222626/Java.Eclipse.Jetty.Report_.The.Parsing.Priority.of.the.Delimiter.pdf
github	www.github.com/user-attachments/files/22222627/Java.Eclipse.Jetty.Report_.Parsing.Difference.Due.to.Deformed.Scheme.pdf
github	www.github.com/user-attachments/files/22222630/Java.Eclipse.Jetty.Report_.Improper.IPv4-mapped.IPv6.Parsing.pdf
github	www.github.com/advisories/GHSA-wjpw-4j6x-6rwh

04 May 2026 11:32Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.13.7 - 6.5

EPSS0.00159

SSVC

CWE-20