CVE-2025-11143

mediumpriority · track · 26EPSS 0.002 · 5 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.17% (5th) EPSS

CVSS 6.5 · medium

Is it mine?

31 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · suse_csaf

EPSS · scored 2026-10-22

The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedjetty-annotations-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-annotations-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-annotations-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-annotations-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-ant-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-ant-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-ant-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-ant-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-cdi-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-cdi-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-cdi-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-cdi-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-client-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-client-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-client-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-client-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-continuation-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-continuation-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-continuation-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-continuation-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-deploy-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-deploy-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-deploy-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-deploy-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-fcgi-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-fcgi-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-fcgi-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-fcgi-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-http-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-http-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-http-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-http-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-http-spi-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-http-spi-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-http-spi-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-http-spi-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-io-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-io-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-io-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-io-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jaas-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jaas-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jaas-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jaas-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jmx-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jmx-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jmx-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jmx-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jndi-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jndi-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jndi-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jndi-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jsp-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jsp-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jsp-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-jsp-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-minimal-javadoc-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-minimal-javadoc-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-minimal-javadoc-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-minimal-javadoc-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-openid-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-openid-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-openid-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-openid-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-plus-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-plus-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-plus-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-plus-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-project-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-project-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-project-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-project-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-proxy-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-proxy-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-proxy-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-proxy-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-quickstart-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-quickstart-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-quickstart-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-quickstart-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-rewrite-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-rewrite-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-rewrite-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-rewrite-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-security-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-security-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-security-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-security-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-server-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-server-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-server-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-server-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-servlet-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-servlet-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-servlet-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-servlet-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-servlets-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-servlets-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-servlets-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-servlets-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-start-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-start-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-start-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-start-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-util-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-util-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-util-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-util-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-util-ajax-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-util-ajax-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-util-ajax-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-util-ajax-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-webapp-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-webapp-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-webapp-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-webapp-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-xml-0:9.4.58-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-xml-0:9.4.58-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-xml-0:9.4.58-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedjetty-xml-0:9.4.58-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.7–6.5

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 2.5

v3.13.7lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · ENISA EU

v3.13.7lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · emo@eclipse.orgexploitability 2.2 · impact 1.4

v3.13.7lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · OSV

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.13.7lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · SUSE Product Security

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20US

affected products (31)

Products and version ranges known to be affected.

IBM Business Automation Workflowall versionscert_bundDEcpe:/a:ibm:business_automation_workflow:-
IBM Operational Decision Managerall versionscert_bundDEcpe:/a:ibm:operational_decision_manager:-
IBM Operational Decision Manager 8.11.0.1all versionscert_bundDEcpe:/a:ibm:operational_decision_manager:8.11.0.1
IBM Operational Decision Manager 8.11.1.0all versionscert_bundDEcpe:/a:ibm:operational_decision_manager:8.11.1.0
IBM Operational Decision Manager 8.12.0.1all versionscert_bundDEcpe:/a:ibm:operational_decision_manager:8.12.0.1
IBM Operational Decision Manager 9.0.0.1all versionscert_bundDEcpe:/a:ibm:operational_decision_manager:9.0.0.1
IBM Operational Decision Manager 9.5.0.1all versionscert_bundDEcpe:/a:ibm:operational_decision_manager:9.5.0.1
IBM SPSSall versionscert_bundDEcpe:/a:ibm:spss:modeler
IBM Spectrum Scaleall versionscert_bundDEcpe:/a:ibm:spectrum_scale:-
IBM Tivoli Network Manager IP Edition 4.2.0all versionscert_bundDEcpe:/a:ibm:tivoli_network_manager:ip_edition_4.2.0
NetApp ActiveIQ Unified Managerall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:-
Red Hat Enterprise Linux Offline Knowledge Portalall versionscert_bundDEcpe:/o:redhat:enterprise_linux:offline_knowledge_portal
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Eclipse Jetty< 12.0.31cert_bundDE
Eclipse Jetty< 12.1.5cert_bundDE
Eclipse Foundation Eclipse Jetty≤ 10.0.0 ≤10.0.26enisa_euvdEU
Eclipse Foundation Eclipse Jetty≤ 11.0.0 ≤11.0.26enisa_euvdEU
Eclipse Foundation Eclipse Jetty≤ 12.1.0 ≤12.1.4enisa_euvdEU
Eclipse Foundation Eclipse Jetty≤ 9.4.0 ≤9.4.58enisa_euvdEU

showing 20 of 31

advisories (4)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-0611Eclipse Jetty: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2026-03-04csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Eclipse Jetty ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
WID-SEC-W-2026-0862RealObjects PDFreactor: Mehrere SchwachstellenDeutsch2026-03-25csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in RealObjects PDFreactor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere, nicht näher spezifizierte Angriffe durchzuführen.
openSUSE-SU-2026:10300-1jetty-annotations-9.4.58-3.1 on GA media2026-03-07csaf · suse_csafDE
jetty-annotations-9.4.58-3.1 on GA media
GHSA-wjpw-4j6x-6rwhorg.eclipse.jetty:jetty-http has different parsing of invalid URIs2026-03-05ghsa · osvUS
The Jetty URI parser has some key differences compared to other common parsers when evaluating invalid or unusual URIs. Specifically: #### Invalid Scheme | URI | Jetty | uri-js (nodejs) | node-url(nodejs) | |---|---|---| --- | | `https>://vulndetector.com/path` | scheme=`http>`| scheme=`https` | invalid URI | #### Improper IPv4 mapped IPv6 | URI | Jetty | System.Uri(CSharp) | curl(C) | |---|---|---| --- | | `http://[0:0:0:0:0:ffff:127.0.0.1]` | invalid | host=`[::ffff:127.0.0.1]` | host=`[::ffff:127.0.0.1]` | | `http://[::ffff:255.255.0.0]` | invalid | host=`[::ffff:255.255.0.0]` | host=`[::ffff:255.255.0.0]` | #### Incorrect IPv6 delimeter priority | URI | Jetty | urllib3(python) | furl(python) | Spring | chromium | |---|---|---| --- |---|---| | `http://[normal.com@]vulndetector.com/` | host=`[normal.com@]` | invalid | invalid | | | | `http://normal.com[user@vulndetector].com/` | host=`[noirmal.com@vulndetector | | | host=`normal.com` | invalid | | `http://normal.com[@]vulndetector.com/` | host=`normal.com[@] | | | host=`normal.com` | invalid | #### Incorrect delimeter priority | URI | Jetty | urllib3(python) | jersey | |---|---|---| --- | | `http://normal.com/#@vulndetector.com` | host=`vulndetector.com` | host=`normal.com` | host=`normal.com` | | `http://normal.com/?@vulndetector.com` | host=`vulndetector.com` | host=`normal.com` | host=`normal.com` | ### Impact Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details. ### Patches Patched in Supported Open Source versions. * 12.1.5 - Supported and available on Maven Central * 12.0.31 - Supported and available on Maven Central * 11.0.x - EOL Release, patches available on [tuxcare](https://tuxcare.com/) and [herodevs](https://www.herodevs.com/) * 10.0.x - EOL Release, patches available on [tuxcare](https://tuxcare.com/) and [herodevs](https://www.herodevs.com/) * 9.4.x - EOL Release, patches available on [tuxcare](https://tuxcare.com/) and [herodevs](https://www.herodevs.com/) ### Workarounds None ### Resources + [Java Eclipse Jetty Report_ Incorrect Parsing Priority of the IPv6 Hostname Delimeter.pdf](https://github.com/user-attachments/files/22222625/Java.Eclipse.Jetty.Report_.Incorrect.Parsing.Priority.of.the.IPv6.Hostname.Delimeter.pdf) + [Java Eclipse Jetty Report_ The Parsing Priority of the Delimiter.pdf](https://github.com/user-attachments/files/22222626/Java.Eclipse.Jetty.Report_.The.Parsing.Priority.of.the.Delimiter.pdf) + [Java Eclipse Jetty Report_ Parsing Difference Due to Deformed Scheme.pdf](https://github.com/user-attachments/files/22222627/Java.Eclipse.Jetty.Report_.Parsing.Difference.Due.to.Deformed.Scheme.pdf) + [Java Eclipse Jetty Report_ Improper IPv4-mapped IPv6 Parsing.pdf](https://github.com/user-attachments/files/22222630/Java.Eclipse.Jetty.Report_.Improper.IPv4-mapped.IPv6.Parsing.pdf)

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund suse_csaf osv NVD CVE.org MITRE

published 2026-03-05modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan