Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in jetty-http (CVE-2025-11143)

Summary IBM Sterling Control Center is affected by a vulnerability CVE-2025-11143 reported for jetty-http-12.0.25.jar. Vulnerability Details CVEID:CVE-2025-11143 DESCRIPTION: The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differentia...

Security Bulletin: IBM Guardium Data Protection is affected by a single vulnerability (CVE-2025-5115)

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2025-5115 DESCRIPTION: In Eclipse Jetty, versions =9.4.57, =10.0.25, =11.0.25, =12.0.21, =12.1.0.alpha2, an HTTP/2 client may trigger the server to send RSTSTREAM frames, for exampl...

ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +9899 more potentially affected by CVE-2026-2332 via org.eclipse.jetty:jetty-http (>=9.4.0.v20161208, <=9.4.58.v20250814)

org.eclipse.jetty:jetty-http MAVEN version =9.4.0.v20161208, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.13.0, =0.1.7, =0.1.7, =0.17.0, =0.15.0, =0.16.0 and more Source cves: CVE-2026-2332 Source advisory: GHSA-355H-QMC2-WPWF...

ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +9899 more potentially affected by CVE-2026-2332 via org.eclipse.jetty:jetty-http (>=9.4.0.v20161208, <=9.4.58.v20250814)

org.eclipse.jetty:jetty-http MAVEN version =9.4.0.v20161208, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.13.0, =0.1.7, =0.1.7, =0.17.0, =0.15.0, =0.16.0 and more Source cves: CVE-2026-2332 Source advisory: OSV:GHSA-355H-QMC2-WPWF...

ai.konduit.serving:konduit-serving-common-tests (0.3.0), app.cash.backfila:client-misk (>=0.1.4-20221221.1702-8b7db03, <=2026.10.01.201111-ad9f619) +1031 more potentially affected by CVE-2026-2332 via org.eclipse.jetty:jetty-http (>=10.0.0, <=10.0.26)

org.eclipse.jetty:jetty-http MAVEN version =10.0.0, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =2023.06.07.114626-93b9d6f, =0.1.4-20221128.2102-bdd85b6, =0.1.4-20221128.2102-bdd85b6, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.6.0, =6.4.0, =6.4.0, =6.10.5 and more Source...

ai.pipestream:pipestream-wiremock-server (>=0.1.1, <=0.1.6), ai.timefold.solver.enterprise:timefold-solver-enterprise-service-test (2.8.0-rc-1) +1768 more potentially affected by CVE-2026-2332 via org.eclipse.jetty:jetty-http (>=11.0.0, <=11.0.26)

org.eclipse.jetty:jetty-http MAVEN version =11.0.0, =0.1.1, =2.2.0, =0.1.6, =4.0.0-beta.1, =0.1.0-rc, =3.24.1, =3.24.1, =3.24.1, =3.27.0, =3.27.0, =3.24.1, =3.24.1, =3.24.1, =3.29.5 and more Source cves: CVE-2026-2332 Source advisory: GHSA-355H-QMC2-WPWF...

ai.pipestream:pipestream-wiremock-server (>=0.1.1, <=0.1.6), ai.timefold.solver.enterprise:timefold-solver-enterprise-service-test (2.8.0-rc-1) +1768 more potentially affected by CVE-2026-2332 via org.eclipse.jetty:jetty-http (>=11.0.0, <=11.0.26)

org.eclipse.jetty:jetty-http MAVEN version =11.0.0, =0.1.1, =2.2.0, =0.1.6, =4.0.0-beta.1, =0.1.0-rc, =3.24.1, =3.24.1, =3.24.1, =3.27.0, =3.27.0, =3.24.1, =3.24.1, =3.24.1, =3.29.5 and more Source cves: CVE-2026-2332 Source advisory: OSV:GHSA-355H-QMC2-WPWF...

ai.agentscentral:agentj-jetty (>=0.0.4, <=0.0.6), app.cash.tempest:tempest-testing-jvm (>=1.4.0, <=2025.04.17.121601-f8f94b6) +2324 more potentially affected by CVE-2026-2332 via org.eclipse.jetty:jetty-http (>=12.0.0, <=12.0.32)

org.eclipse.jetty:jetty-http MAVEN version =12.0.0, =0.0.4, =1.4.0, =1.4.0, =7.0.0, =4.2.0, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.21 and more Source cves: CVE-2026-2332 Source advisory: GHSA-355H-QMC2-WPWF...

ai.pipestream:pipestream-wiremock-server (>=0.1.7, <=0.1.8), cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3) +1625 more potentially affected by CVE-2026-2332 via org.eclipse.jetty:jetty-http (>=12.1.0, <=12.1.6)

org.eclipse.jetty:jetty-http MAVEN version =12.1.0, =0.1.7, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =3.0.0, =21.3.3, =0.5.0, =0.9.0, =1.1.1 - com.condation.cms.modules:api-module 8.0.0 and more Source cves: CVE-2026-2332 Source advisory: GHSA-355H-QMC2-WPWF...

ai.pipestream:pipestream-wiremock-server (>=0.1.7, <=0.1.8), cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3) +1625 more potentially affected by CVE-2026-2332 via org.eclipse.jetty:jetty-http (>=12.1.0, <=12.1.6)

org.eclipse.jetty:jetty-http MAVEN version =12.1.0, =0.1.7, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =3.0.0, =21.3.3, =0.5.0, =0.9.0, =1.1.1 - com.condation.cms.modules:api-module 8.0.0 and more Source cves: CVE-2026-2332 Source advisory: OSV:GHSA-355H-QMC2-WP...

HTTP Request Smuggling

Overview org.eclipse.jetty:jetty-http is an is a http module for jetty server. Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/1.1 parser HttpParser.java. An attacker can inject additional HTTP requests with chunked transfer encoding with improperly terminat...

ai.pipestream:pipestream-wiremock-server (>=0.1.7, <=0.1.8), cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3) +1632 more potentially affected by CVE-2026-2332 via org.eclipse.jetty:jetty-http (>=12.1.0.alpha0, <=12.1.6)

org.eclipse.jetty:jetty-http MAVEN version =12.1.0.alpha0, =0.1.7, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =3.0.0, =21.3.3, =0.5.0, =0.9.0, =1.1.1 - com.condation.cms.modules:api-module 8.0.0 and more Source cves: CVE-2026-2332 Source advisory:...

ai.pipestream:pipestream-wiremock-server (>=0.1.7, <=0.1.8), cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3) +1625 more potentially affected by CVE-2026-2332 via org.eclipse.jetty:jetty-http (>=12.1.0, <=12.1.6)

org.eclipse.jetty:jetty-http MAVEN version =12.1.0, =0.1.7, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =3.0.0, =21.3.3, =0.5.0, =0.9.0, =1.1.1 - com.condation.cms.modules:api-module 8.0.0 and more Source cves: CVE-2026-2332 Source advisory: MEND:CVE-2026-2332...

ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +9704 more potentially affected by CVE-2025-11143 via org.eclipse.jetty:jetty-http (>=9.4.0.v20161208, <=9.4.57.v20241219)

org.eclipse.jetty:jetty-http MAVEN version =9.4.0.v20161208, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.13.0, =0.1.7, =0.1.7, =0.17.0, =0.15.0, =0.16.0 and more Source cves: CVE-2025-11143 Source advisory: OSV:GHSA-WJPW-4J6X-6RWH...

ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +9704 more potentially affected by CVE-2025-11143 via org.eclipse.jetty:jetty-http (>=9.4.0.v20161208, <=9.4.57.v20241219)

org.eclipse.jetty:jetty-http MAVEN version =9.4.0.v20161208, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.13.0, =0.1.7, =0.1.7, =0.17.0, =0.15.0, =0.16.0 and more Source cves: CVE-2025-11143 Source advisory: GHSA-WJPW-4J6X-6RWH...

cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3), cn.herodotus.dante:servlet-message-spring-boot-starter (>=4.0.0.0-m2, <=4.0.0.0-m3) +800 more potentially affected by CVE-2025-11143 via org.eclipse.jetty:jetty-http (>=12.1.0, <=12.1.4)

org.eclipse.jetty:jetty-http MAVEN version =12.1.0, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =21.3.3, =0.2.1-alpha, =0.2.1-alpha, =4.0.0-1215, =4.0.0-1215, =2.4.2, =2.4.5 - com.github.cafaudit:caf-audit-service-container 5.0.5-1360 and more Source cves:...

cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3), cn.herodotus.dante:servlet-message-spring-boot-starter (>=4.0.0.0-m2, <=4.0.0.0-m3) +800 more potentially affected by CVE-2025-11143 via org.eclipse.jetty:jetty-http (>=12.1.0, <=12.1.4)

org.eclipse.jetty:jetty-http MAVEN version =12.1.0, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =21.3.3, =0.2.1-alpha, =0.2.1-alpha, =4.0.0-1215, =4.0.0-1215, =2.4.2, =2.4.5 - com.github.cafaudit:caf-audit-service-container 5.0.5-1360 and more Source cves:...

cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3), cn.herodotus.dante:servlet-message-spring-boot-starter (>=4.0.0.0-m2, <=4.0.0.0-m3) +800 more potentially affected by CVE-2025-11143 via org.eclipse.jetty:jetty-http (>=12.1.0, <=12.1.4)

org.eclipse.jetty:jetty-http MAVEN version =12.1.0, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =21.3.3, =0.2.1-alpha, =0.2.1-alpha, =4.0.0-1215, =4.0.0-1215, =2.4.2, =2.4.5 - com.github.cafaudit:caf-audit-service-container 5.0.5-1360 and more Source cves:...

EUVD-2004-2469

Malware in sbrugna...

EUVD-2022-1793

Malicious code in bioql PyPI...