6.5

CVE-2025-11143: eclipse foundation eclipse jetty Improper Input Validation

CVSS: 6.5v3.1MediumAnalyzed
AliasesSUSE-SU-2026:1461-1UBUNTU-CVE-2025-11143DEBIAN-CVE-2025-11143
Published 05-03-2026Last modified 05-03-2026
Open JSON

Vulnerability summary

CVE-2025-11143 is a medium (CVSS 6.5) Improper Input Validation vulnerability in eclipse foundation eclipse jetty. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.9% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.16%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-M846-HWG2-33FG

Timeline

  1. 05-03-2026
    PublishedVulnerability first disclosed.
  2. 05-03-2026
    Last modifiedVulnerability information updated.

Description

The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.16%

Chance of exploitation in the next 30 days

Percentile

5%

Versus all other CVEs

30-day change

0.00 pp

From 0.16% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.16%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard134 products
  • akhq< 0.26.0-r10
  • apache-activemq-6.1All versions (No fix recorded)
  • apache-activemq-6.2All versions (No fix recorded)
  • apache-activemq-fips-6.1All versions (No fix recorded)
  • apache-activemq-fips-6.2All versions (No fix recorded)
Wolfi41 products
  • akhq< 0.26.0-r10
  • apache-tika-3.1< 3.1.0-r38
  • apache-tika-3.2< 3.2.3-r18
  • apache-tika-3.2-compatAll versions (No fix recorded)
  • apache-tika-3.3< 3.3.2-r2
Opensuse3 products
  • jetty-minimal&distro=openSUSE Leap 15.6< 9.4.58-150200.3.37.1
  • jetty-minimal&distro=openSUSE Tumbleweed< 9.4.58-3.1
  • jetty-websocket&distro=openSUSE Leap 15.6< 9.4.58-150200.3.37.1
Debian2 products
  • jetty12All versions (No fix recorded) | < 12.0.32-1
  • jetty9All versions (No fix recorded)
Suse2 products
  • jetty-minimal&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7< 9.4.58-150200.3.37.1
  • jetty-minimal&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 9.4.58-150200.3.37.1
Ubuntu2 products
  • jetty12All versions (No fix recorded)
  • jetty9All versions (No fix recorded)
Eclipse1 product
  • jetty≥ 9.4.0, ≤ 9.4.58 | ≥ 10.0.0, ≤ 10.0.26 | ≥ 11.0.0, ≤ 11.0.26 | ≥ 12.0.0, < 12.0.31 | ≥ 12.1.0, < 12.1.5
Eclipse foundation1 product
  • eclipse jetty≥ 9.4.0, ≤ 9.4.58 | ≥ 10.0.0, ≤ 10.0.26 | ≥ 11.0.0, ≤ 11.0.26 | ≥ 12.0.0, ≤ 12.0.30 | ≥ 12.1.0, ≤ 12.1.4
Org.eclipse.jetty1 product
  • jetty-http≥ 9.4.0, ≤ 9.4.58 | ≥ 10.0.0, ≤ 10.0.26 | ≥ 11.0.0, ≤ 11.0.26 | ≥ 12.0.0, < 12.0.31 | ≥ 12.1.0, < 12.1.5

9 vendors · 187 products

References

14 links
Show all 14 references