Improper input validation in Eclipse Jetty
CVE-2025-11143
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.002 (5.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Eclipse Jetty
- Eclipse Foundation Jetty — versions 9.4.0, 10.0.0, 11.0.0
Weakness classification (CWE)
References
- emo@eclipse.org (Vendor Advisory)
Frequently asked questions
- What is CVE-2025-11143?
- CVE-2025-11143 is a low-severity vulnerability in Eclipse Jetty, classified under Improper Input Validation. CVSS score: 3.7/10. Published 2026-03-05.
- How severe is CVE-2025-11143?
- Low severity. CVSS v3 base score is 3.7 out of 10.