GHSA-wjpw-4j6x-6rwh
LOWorg.eclipse.jetty:jetty-http has different parsing of invalid URIs
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Blast Radius
org.eclipse.jetty:jetty-http☕org.eclipse.jetty:jetty-http☕org.eclipse.jetty:jetty-http☕org.eclipse.jetty:jetty-http☕org.eclipse.jetty:jetty-httpReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
The Jetty URI parser has some key differences compared to other common parsers when evaluating invalid or unusual URIs. Specifically:
Invalid Scheme
| URI | Jetty | uri-js (nodejs) | node-url(nodejs) |
|---|---|---|---|
https>://vulndetector.com/path | scheme=http> | scheme=https | invalid URI |
Improper IPv4 mapped IPv6
| URI | Jetty | System.Uri(CSharp) | curl(C) |
|---|---|---|---|
http://[0:0:0:0:0:ffff:127.0.0.1] | invalid | host=[::ffff:127.0.0.1] | host=[::ffff:127.0.0.1] |
http://[::ffff:255.255.0.0] | invalid | host=[::ffff:255.255.0.0] | host=[::ffff:255.255.0.0] |
Incorrect IPv6 delimeter priority
| URI | Jetty | urllib3(python) | furl(python) | Spring | chromium |
|---|---|---|---|---|---|
http://[normal.com@]vulndetector.com/ | host=[normal.com@] | invalid | invalid | ||
http://normal.com[user@vulndetector].com/ | host=`[noirmal.com@vulndetector | host=normal.com | invalid | ||
http://normal.com[@]vulndetector.com/ | host=`normal.com[@] | host=normal.com | invalid |
Incorrect delimeter priority
| URI | Jetty | urllib3(python) | jersey |
|---|---|---|---|
http://normal.com/#@vulndetector.com | host=vulndetector.com | host=normal.com | host=normal.com |
http://normal.com/[email protected] | host=vulndetector.com | host=normal.com | host=normal.com |
Impact
Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
Patches
Patched in Supported Open Source versions.
- 12.1.5 - Supported and available on Maven Central
- 12.0.31 - Supported and available on Maven Central
- 11.0.x - EOL Release, patches available on tuxcare and herodevs
- 10.0.x - EOL Release, patches available on tuxcare and herodevs
- 9.4.x - EOL Release, patches available on tuxcare and herodevs
Workarounds
None
Resources
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.eclipse.jetty:jetty-http | ≥ 9.4.0 | No fix |
| ☕Maven | org.eclipse.jetty:jetty-http | ≥ 10.0.0 | No fix |
| ☕Maven | org.eclipse.jetty:jetty-http | ≥ 11.0.0 | No fix |
| ☕Maven | org.eclipse.jetty:jetty-http | ≥ 12.0.0&&< 12.0.31 | 12.0.31 |
| ☕Maven | org.eclipse.jetty:jetty-http | ≥ 12.1.0&&< 12.1.5 | 12.1.5 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.eclipse.jetty:jetty-http. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
No patched version of org.eclipse.jetty:jetty-http has shipped for GHSA-wjpw-4j6x-6rwh yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-wjpw-4j6x-6rwh is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-wjpw-4j6x-6rwh. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-wjpw-4j6x-6rwh in your dependencies?
O3 detects GHSA-wjpw-4j6x-6rwh across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.