{"id":"GHSA-wjpw-4j6x-6rwh","summary":"org.eclipse.jetty:jetty-http has different parsing of invalid URIs","details":"The Jetty URI parser has some key differences compared to other common parsers when evaluating invalid or unusual URIs. Specifically:\n\n#### Invalid Scheme\n| URI | Jetty | uri-js (nodejs) | node-url(nodejs) |\n|---|---|---| --- |\n| `https\u003e://vulndetector.com/path` | scheme=`http\u003e`| scheme=`https` | invalid URI |\n\n#### Improper IPv4 mapped IPv6\n\n| URI | Jetty | System.Uri(CSharp) | curl(C) |\n|---|---|---| --- |\n| `http://[0:0:0:0:0:ffff:127.0.0.1]` | invalid | host=`[::ffff:127.0.0.1]` | host=`[::ffff:127.0.0.1]` | \n| `http://[::ffff:255.255.0.0]` | invalid | host=`[::ffff:255.255.0.0]` | host=`[::ffff:255.255.0.0]` | \n\n#### Incorrect IPv6 delimeter priority\n\n| URI | Jetty | urllib3(python) | furl(python) | Spring | chromium |\n|---|---|---| --- |---|---|\n| `http://[normal.com@]vulndetector.com/` | host=`[normal.com@]` | invalid | invalid | | |\n| `http://normal.com[user@vulndetector].com/`  | host=`[noirmal.com@vulndetector | | | host=`normal.com` | invalid |\n| `http://normal.com[@]vulndetector.com/`  | host=`normal.com[@] | | | host=`normal.com` | invalid |\n\n#### Incorrect delimeter priority\n\n| URI | Jetty | urllib3(python) | jersey |\n|---|---|---| --- |\n| `http://normal.com/#@vulndetector.com` | host=`vulndetector.com` | host=`normal.com` | host=`normal.com` |\n| `http://normal.com/?@vulndetector.com` | host=`vulndetector.com` | host=`normal.com` | host=`normal.com` |\n\n\n### Impact\nDifferential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response.\nAt the very least, differential parsing may divulge implementation details. \n\n### Patches\nPatched in Supported Open Source versions.\n* 12.1.5 - Supported and available on Maven Central\n* 12.0.31 - Supported and available on Maven Central\n* 11.0.x  - EOL Release, patches available on [tuxcare](https://tuxcare.com/) and [herodevs](https://www.herodevs.com/)\n* 10.0.x  - EOL Release, patches available on [tuxcare](https://tuxcare.com/) and [herodevs](https://www.herodevs.com/)\n* 9.4.x - EOL Release, patches available on [tuxcare](https://tuxcare.com/) and [herodevs](https://www.herodevs.com/)\n\n### Workarounds\nNone\n\n### Resources\n\n + [Java Eclipse Jetty Report_ Incorrect Parsing Priority of the IPv6 Hostname Delimeter.pdf](https://github.com/user-attachments/files/22222625/Java.Eclipse.Jetty.Report_.Incorrect.Parsing.Priority.of.the.IPv6.Hostname.Delimeter.pdf)\n + [Java Eclipse Jetty Report_ The Parsing Priority of the Delimiter.pdf](https://github.com/user-attachments/files/22222626/Java.Eclipse.Jetty.Report_.The.Parsing.Priority.of.the.Delimiter.pdf)\n + [Java Eclipse Jetty Report_ Parsing Difference Due to Deformed Scheme.pdf](https://github.com/user-attachments/files/22222627/Java.Eclipse.Jetty.Report_.Parsing.Difference.Due.to.Deformed.Scheme.pdf)\n + [Java Eclipse Jetty Report_ Improper IPv4-mapped IPv6 Parsing.pdf](https://github.com/user-attachments/files/22222630/Java.Eclipse.Jetty.Report_.Improper.IPv4-mapped.IPv6.Parsing.pdf)","aliases":["CVE-2025-11143"],"modified":"2026-09-10T03:50:41.746719137Z","published":"2026-03-05T21:41:25Z","database_specific":{"github_reviewed_at":"2026-03-05T21:41:25Z","nvd_published_at":"2026-03-05T10:15:54Z","cwe_ids":["CWE-20"],"severity":"LOW","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11143"},{"type":"PACKAGE","url":"https://github.com/jetty/jetty.project"},{"type":"WEB","url":"https://github.com/user-attachments/files/22222625/Java.Eclipse.Jetty.Report_.Incorrect.Parsing.Priority.of.the.IPv6.Hostname.Delimeter.pdf"},{"type":"WEB","url":"https://github.com/user-attachments/files/22222626/Java.Eclipse.Jetty.Report_.The.Parsing.Priority.of.the.Delimiter.pdf"},{"type":"WEB","url":"https://github.com/user-attachments/files/22222627/Java.Eclipse.Jetty.Report_.Parsing.Difference.Due.to.Deformed.Scheme.pdf"},{"type":"WEB","url":"https://github.com/user-attachments/files/22222630/Java.Eclipse.Jetty.Report_.Improper.IPv4-mapped.IPv6.Parsing.pdf"}],"affected":[{"package":{"name":"org.eclipse.jetty:jetty-http","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty/jetty-http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0"},{"last_affected":"9.4.58"}]}],"versions":["9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.5.v20170502","9.4.5.v20180619","9.4.50.v20221201","9.4.51.v20230217","9.4.52.v20230823","9.4.53.v20231009","9.4.54.v20240208","9.4.55.v20240627","9.4.56.v20240826","9.4.57.v20241219","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-wjpw-4j6x-6rwh/GHSA-wjpw-4j6x-6rwh.json"}},{"package":{"name":"org.eclipse.jetty:jetty-http","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty/jetty-http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"last_affected":"10.0.26"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.17","10.0.18","10.0.19","10.0.2","10.0.20","10.0.21","10.0.22","10.0.23","10.0.24","10.0.25","10.0.26","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-wjpw-4j6x-6rwh/GHSA-wjpw-4j6x-6rwh.json"}},{"package":{"name":"org.eclipse.jetty:jetty-http","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty/jetty-http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"last_affected":"11.0.26"}]}],"versions":["11.0.0","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.17","11.0.18","11.0.19","11.0.2","11.0.20","11.0.21","11.0.22","11.0.23","11.0.24","11.0.25","11.0.26","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-wjpw-4j6x-6rwh/GHSA-wjpw-4j6x-6rwh.json"}},{"package":{"name":"org.eclipse.jetty:jetty-http","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty/jetty-http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.31"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 12.0.30","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-wjpw-4j6x-6rwh/GHSA-wjpw-4j6x-6rwh.json"}},{"package":{"name":"org.eclipse.jetty:jetty-http","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty/jetty-http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.5"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-wjpw-4j6x-6rwh/GHSA-wjpw-4j6x-6rwh.json","last_known_affected_version_range":"\u003c= 12.1.4"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}