Input validation error in Jetty - CVE-2025-11143

Vulnerability identifier: #VU123576

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-11143

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to a differential parsing of URIs between different components of the application. A remote attacker can use such behavior to bypass implemented security restrictions. 

Jetty
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Development Tools Module
SUSE Package Hub 15
openSUSE Leap
Anolis OS
Operations Analytics - Log Analysis
MongoDB Enterprise Advanced with IBM
Maximo Application Suite - IoT Component
IBM Engineering Systems Design Rhapsody
IBM Sterling Connect:Direct for Microsoft Windows
IBM Sterling Secure Proxy
IBM Sterling External Authentication Server
IBM Sterling Control Center
IBM SPSS Collaboration and Deployment Services
IBM Business Automation Workflow
Operational Decision Manager
Oracle GoldenGate Big Data and Application Adapters
jetty-io
jetty
jetty-client
jetty-continuation
jetty-http
jetty-jaas
jetty-javadoc
jetty-jmx
jetty-security
jetty-server
jetty-servlet
jetty-util
jetty-util-ajax
jetty-webapp
jetty-xml
jetty-fcgi
jetty-quickstart
jetty-websocket-javadoc
jetty-websocket-api
jetty-annotations
jetty-project
jetty-http-spi
jetty-cdi
jetty-plus
jetty-websocket-servlet
jetty-deploy
jetty-websocket-common
jetty-start
jetty-minimal-javadoc
jetty-javax-websocket-client-impl
jetty-jsp
jetty-websocket-client
jetty-openid
jetty-servlets
jetty-rewrite
jetty-ant
jetty-proxy
jetty-websocket-server
jetty-jndi
jetty-javax-websocket-server-impl

Install updates from vendor's website.

Jetty - addressed in versions 12.0.31, 12.1.5
Operations Analytics - Log Analysis - update to 1.3.8.4
IBM Sterling Secure Proxy - update to 6.2.1.2.iFix02
IBM Sterling External Authentication Server - update to 6.1.1.3 iFix01
IBM Sterling Control Center - addressed in versions 6.3.1.0.8, 6.4.1.0.2, 6.4.2.0.3
MongoDB Enterprise Advanced with IBM - addressed in versions 1.16.0, 8.0.22
Maximo Application Suite - IoT Component - addressed in versions 9.0.22, 9.1.13, 9.2.1
IBM Engineering Systems Design Rhapsody - addressed in versions 10.0.0.5, 10.0.1.0.5, 10.0.2.0.4
IBM Business Automation Workflow - addressed in versions 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0
IBM Sterling Connect:Direct for Microsoft Windows - addressed in versions 6.3.0.6.51, 6.4.0.4.22
jetty-io - update to 9.4.43-8
jetty - update to 9.4.43-8
jetty-client - update to 9.4.43-8
jetty-continuation - update to 9.4.43-8
jetty-http - update to 9.4.43-8
jetty-jaas - update to 9.4.43-8
jetty-javadoc - update to 9.4.43-8
jetty-jmx - update to 9.4.43-8
jetty-security - update to 9.4.43-8
jetty-server - update to 9.4.43-8
jetty-servlet - update to 9.4.43-8
jetty-util - update to 9.4.43-8
jetty-util-ajax - update to 9.4.43-8
jetty-webapp - update to 9.4.43-8
jetty-xml - update to 9.4.43-8
jetty-fcgi - update to 9.4.58-150200.3.37.1
jetty-client - update to 9.4.58-150200.3.37.1
jetty-quickstart - update to 9.4.58-150200.3.37.1
jetty-websocket-javadoc - update to 9.4.58-150200.3.37.1
jetty-websocket-api - update to 9.4.58-150200.3.37.1
jetty-server - update to 9.4.58-150200.3.37.1
jetty-annotations - update to 9.4.58-150200.3.37.1
jetty-http - update to 9.4.58-150200.3.37.1
jetty-project - update to 9.4.58-150200.3.37.1
jetty-http-spi - update to 9.4.58-150200.3.37.1
jetty-cdi - update to 9.4.58-150200.3.37.1
jetty-util - update to 9.4.58-150200.3.37.1
jetty-jmx - update to 9.4.58-150200.3.37.1
jetty-plus - update to 9.4.58-150200.3.37.1
jetty-websocket-servlet - update to 9.4.58-150200.3.37.1
jetty-deploy - update to 9.4.58-150200.3.37.1
jetty-websocket-common - update to 9.4.58-150200.3.37.1
jetty-webapp - update to 9.4.58-150200.3.37.1
jetty-security - update to 9.4.58-150200.3.37.1
jetty-start - update to 9.4.58-150200.3.37.1
jetty-minimal-javadoc - update to 9.4.58-150200.3.37.1
jetty-javax-websocket-client-impl - update to 9.4.58-150200.3.37.1
jetty-jsp - update to 9.4.58-150200.3.37.1
jetty-websocket-client - update to 9.4.58-150200.3.37.1
jetty-openid - update to 9.4.58-150200.3.37.1
jetty-util-ajax - update to 9.4.58-150200.3.37.1
jetty-servlets - update to 9.4.58-150200.3.37.1
jetty-rewrite - update to 9.4.58-150200.3.37.1
jetty-ant - update to 9.4.58-150200.3.37.1
jetty-xml - update to 9.4.58-150200.3.37.1
jetty-io - update to 9.4.58-150200.3.37.1
jetty-proxy - update to 9.4.58-150200.3.37.1
jetty-servlet - update to 9.4.58-150200.3.37.1
jetty-websocket-server - update to 9.4.58-150200.3.37.1
jetty-jndi - update to 9.4.58-150200.3.37.1
jetty-jaas - update to 9.4.58-150200.3.37.1
jetty-javax-websocket-server-impl - update to 9.4.58-150200.3.37.1
jetty-continuation - update to 9.4.58-150200.3.37.1

• https://github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwh

• Security restrictions bypass in Eclipse Jetty
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• SUSE update for jetty-minimal
• Multiple vulnerabilities in Oracle GoldenGate Big Data and Application Adapters
• IBM Control Center update for jetty-http
• Multiple vulnerabilities in IBM Sterling Connect:Direct for Microsoft Windows
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• IBM Engineering Systems Design Rhapsody update for Eclipse Jetty
• MongoDB Enterprise Advanced with IBM Ops-Manager and migrator update for Jetty URI parser
• Multiple vulnerabilities in IBM Operational Decision Manager
• Anolis OS update for jetty
• Multiple vulnerabilities in IBM Sterling Secure Proxy
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Sterling External Authentication Server