jetty12: The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differ...
CVE-2025-11143 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2025-11143, released March 5, 2026. It is not reported as exploited. Patch Radar priority: Routine.
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| jetty-minimal · opensuse-leap 15.6 | 9.4.58-150200.3.37.1 | SUSE-SU-2026:1461-1 | Apr 20, 2026 |
| jetty-minimal · sles 15.7 | 9.4.58-150200.3.37.1 | SUSE-SU-2026:1461-1 | Apr 20, 2026 |
| jetty-websocket · opensuse-leap 15.6 | 9.4.58-150200.3.37.1 | SUSE-SU-2026:1461-1 | Apr 20, 2026 |
| jetty12 · Debian 14 | 12.0.32-1 | DEBIAN-CVE-2025-11143 | Mar 5, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.