CVE-2025-11143

A flaw was found in org.eclipse.jetty. The Jetty URI parser handles invalid or unusual Uniform Resource Identifiers (URIs) differently compared to other common parsers. This discrepancy, known as differential parsing, can lead to security bypasses in systems that use multiple components to process URIs, such as when a blacklist enforcement component interprets a URI differently from a response generation component. At a minimum, this issue could unintentionally reveal internal system details.

This vulnerability is rated as Low by Red Hat. Successful usage of this vulnerability is non-trivial, as the attacker must be able to craft a URI that exploits Jetty's differential parsing while bypassing other parsers (ex. in a firewall or load balancer). Additionally, divulging implementation details is possible but not guaranteed while also being indirect, meaning that an attacker may be able to obtain error messages or behavioral differences, but those are not guaranteed. As such, there is likely no direct leak of sensitive data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.