org.eclipse.jetty:jetty-http has different parsing of invalid URIs
The Jetty URI parser has some key differences compared to other common parsers when evaluating invalid or unusual URIs. Specifically:
Invalid Scheme
| URI | Jetty | uri-js (nodejs) | node-url(nodejs) |
|---|---|---|---|
https>://vulndetector.com/path |
scheme=http> |
scheme=https |
invalid URI |
Improper IPv4 mapped IPv6
| URI | Jetty | System.Uri(CSharp) | curl(C) |
|---|---|---|---|
http://[0:0:0:0:0:ffff:127.0.0.1] |
invalid | host=[::ffff:127.0.0.1] |
host=[::ffff:127.0.0.1] |
http://[::ffff:255.255.0.0] |
invalid | host=[::ffff:255.255.0.0] |
host=[::ffff:255.255.0.0] |
Incorrect IPv6 delimeter priority
| URI | Jetty | urllib3(python) | furl(python) | Spring | chromium |
|---|---|---|---|---|---|
http://[normal.com@]vulndetector.com/ |
host=[normal.com@] |
invalid | invalid | ||
http://normal.com[user@vulndetector].com/ |
host=`[noirmal.com@vulndetector | host=normal.com |
invalid | ||
http://normal.com[@]vulndetector.com/ |
host=`normal.com[@] | host=normal.com |
invalid |
Incorrect delimeter priority
| URI | Jetty | urllib3(python) | jersey |
|---|---|---|---|
http://normal.com/#@vulndetector.com |
host=vulndetector.com |
host=normal.com |
host=normal.com |
http://normal.com/?@vulndetector.com |
host=vulndetector.com |
host=normal.com |
host=normal.com |
Impact
Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
Patches
Patched in Supported Open Source versions.
- 12.1.5 - Supported and available on Maven Central
- 12.0.31 - Supported and available on Maven Central
- 11.0.x - EOL Release, patches available on tuxcare and herodevs
- 10.0.x - EOL Release, patches available on tuxcare and herodevs
- 9.4.x - EOL Release, patches available on tuxcare and herodevs
Workarounds
None
Resources
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.eclipse.jetty:jetty-http | >= 9.4.0, <= 9.4.58, >= 10.0.0, <= 10.0.26, >= 11.0.0, <= 11.0.26, >= 12.0.0, < 12.0.31, >= 12.1.0, < 12.1.5 | 12.0.31, 12.1.5 |
References
- https://github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwh
- https://nvd.nist.gov/vuln/detail/CVE-2025-11143
- https://github.com/jetty/jetty.project
- https://github.com/user-attachments/files/22222625/Java.Eclipse.Jetty.Report_.Incorrect.Parsing.Priority.of.the.IPv6.Hostname.Delimeter.pdf
- https://github.com/user-attachments/files/22222626/Java.Eclipse.Jetty.Report_.The.Parsing.Priority.of.the.Delimiter.pdf
- https://github.com/user-attachments/files/22222627/Java.Eclipse.Jetty.Report_.Parsing.Difference.Due.to.Deformed.Scheme.pdf
- https://github.com/user-attachments/files/22222630/Java.Eclipse.Jetty.Report_.Improper.IPv4-mapped.IPv6.Parsing.pdf
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-20- Platform
- Java / Kotlin (Maven)
- Package
org.eclipse.jetty:jetty-http- Disclosed
- 05.03.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-wjpw-4j6x-6rwh - CC BY 4.0
Vulnerability history: org.eclipse.jetty:jetty-http
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 07.2022 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 2
- Low 2
Disclosures per year
- 2022: 1
- 2023: 1
- 2024: 1
- 2025: 0
- 2026: 2
-
org.eclipse.jetty:jetty-http has different parsing of invalid URIs this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.