Description
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.
The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI
differs from the common browsers in how it handles a URI that would be
considered invalid if fully validated against the RRC. Specifically HttpURI
and the browser may differ on the value of the host extracted from an
invalid URI and thus a combination of Jetty and a vulnerable browser may
be vulnerable to a open redirect attack or to a SSRF attack if the URI
is used after passing validation checks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Eclipse Foundation | Jetty | 7.0.0 – ≤ 12.0.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jetty9 | No fix yet | — |
| Debian 13 | jetty9 | No fix yet | — |
| Debian 12 | jetty9 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 22.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 20.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 18.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 16.04 LTS | jetty +1 | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | jetty | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | jetty-minimal | 9.4.57-150200.3.31.1 | SUSE-SU-2025:01738-1 |
| SLES 15 SP6 | jetty-minimal | 9.4.57-150200.3.31.1 | SUSE-SU-2025:01738-1 |
| SLES 15 SP5 | jetty-minimal | 9.4.57-150200.3.31.1 | SUSE-SU-2025:01738-1 |
| SLES 15 SP4 | jetty-minimal | 9.4.57-150200.3.31.1 | SUSE-SU-2025:01738-1 |
| SLES 15 SP3 | jetty-minimal | 9.4.57-150200.3.31.1 | SUSE-SU-2025:01738-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | jetty-minimal | 9.4.57-150200.3.31.1 | SUSE-SU-2025:01738-1 |
| SLES for SAP 15 SP4 | jetty-minimal | 9.4.57-150200.3.31.1 | SUSE-SU-2025:01738-1 |
| SLES for SAP 15 SP3 | jetty-minimal | 9.4.57-150200.3.31.1 | SUSE-SU-2025:01738-1 |
| SLE HPC 15 SP5 | jetty-minimal | 9.4.57-150200.3.31.1 | SUSE-SU-2025:01738-1 |
| SLE HPC 15 SP4 | jetty-minimal | 9.4.57-150200.3.31.1 | SUSE-SU-2025:01738-1 |
| SLE HPC 15 SP3 | jetty-minimal | 9.4.57-150200.3.31.1 | SUSE-SU-2025:01738-1 |
| SUSE Enterprise Storage 7.1 | jetty-minimal | 9.4.57-150200.3.31.1 | SUSE-SU-2025:01738-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | jetty-minimal | 9.4.57-1.1 | openSUSE-SU-2025:15160-1 |
| openSUSE Leap 15.6 | jetty-minimal | 9.4.57-150200.3.31.1 | SUSE-SU-2025:01738-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | akhq | 0.25.1-r3 | — |
| Wolfi rolling | apache-nifi +2 | 2.0.0-r0 | — |
| Wolfi rolling | apache-tika-3.1 | 3.1.0-r38 | — |
| Wolfi rolling | apache-tika-3.2 +1 | 3.2.3-r18 | — |
| Wolfi rolling | apache-tika-3.3 | 3.3.2-r2 | — |
| Wolfi rolling | cassandra-reaper | 5.0.0-r0 | — |
| Wolfi rolling | cloudwatch-exporter | 0.17.0-r0 | — |
| Wolfi rolling | confluent-kafka | 8.0.0.259-r0 | — |
| Wolfi rolling | druid | 35.0.0-r0 | — |
| Wolfi rolling | spark-4.0-scala-2.13 | 4.0.2-r0 | — |
| Wolfi rolling | spark-4.1-scala-2.13 | 4.1.1-r0 | — |
| Wolfi rolling | tez +1 | No fix yet | — |
| Wolfi rolling | trino +58 | 472-r0 | — |
| Wolfi rolling | zookeeper-3.9 | 3.9.5-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.jetty:jetty-http | >= 7.0.0, < 12.0.12 | 12.0.12 | GHSA-qh8g-58pp-2wxh |
Advisories 11
- WID-SEC-2026-4090 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2024-3176 Eclipse Jetty: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2026
- WID-SEC-2025-0823 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- openSUSE-SU-2025:15160-1 jetty-annotations-9.4.57-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:01738-1 Security update for jetty-minimal SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-1572 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- WID-SEC-2025-1565 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- NCSC-2025-0124 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Apr 16, 2025
- NCSC-2025-0123 Kwetsbaarheden verholpen in Oracle Database Producten NCSC-NL (Netherlands) · Apr 16, 2025
- NCSC-2025-0020 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Jan 22, 2025
- WID-SEC-2025-0138 Oracle REST Data Services: Schwachstelle gefährdet Integrität BSI CERT-Bund (WID) · Jan 21, 2025