The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.
The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution exists | May 15, 2025 | Oct 14, 2024 |
| Red Hat Jboss Eap | — | — | Dec 20, 2024 | Oct 14, 2024 |
| Suse | — | Upgrade jetty-startUpgrade jetty-continuationUpgrade jetty-annotationsUpgrade jetty-plusUpgrade jetty-rewriteUpgrade jetty-clientUpgrade jetty-jmxUpgrade jetty-jaasUpgrade jetty-webappUpgrade jetty-ioUpgrade jetty-fcgiUpgrade jetty-jndiUpgrade jetty-httpUpgrade jetty-http-spiUpgrade jetty-servletsUpgrade jetty-proxyUpgrade jetty-quickstartUpgrade jetty-jspUpgrade jetty-servletUpgrade jetty-openidUpgrade jetty-securityUpgrade jetty-serverUpgrade jetty-deployUpgrade jetty-util-ajaxUpgrade jetty-minimal-javadocUpgrade jetty-cdiUpgrade jetty-antUpgrade jetty-xmlUpgrade jetty-util | Dec 5, 2025 | May 29, 2025 |
| Ubuntu | — | No solution exists | Jul 1, 2025 | Oct 14, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub