1. Home
  2. CVE Database
  3. CVE-2025-11143
LOW · 3.7

CVE-2025-11143

The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security ...

Vulnerability Description

The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.

CVSS Score

3.7

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
EclipseJetty>= 9.4.0, <= 9.4.58

Related Weaknesses (CWE)

CWE-20

References

FAQ

What is CVE-2025-11143?

CVE-2025-11143 is a vulnerability with a CVSS score of 3.7 (LOW). The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security ...

How severe is CVE-2025-11143?

CVE-2025-11143 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-11143?

Check the references section above for vendor advisories and patch information. Affected products include: Eclipse Jetty.