# org.eclipse.jetty:jetty-http (Maven) vulnerabilities 5 known vulnerabilities (1 high, 1 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 12.1.14 (Oct 5, 2026): no advisory affects it - Newest unaffected release: 12.1.14 (Oct 5, 2026), the latest release - Dependents: 513 - Releases: 443 since 7.0.0.v20091005 (Oct 5, 2009) - Registry: https://central.sonatype.com/artifact/org.eclipse.jetty/jetty-http - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-2332: 9.4.0.v20161208 to 9.4.58.v20250814 (10.0.0-alpha0 is outside it); 10.0.0 to 10.0.26 (11.0.0-alpha0 is outside it); 11.0.0 to 11.0.26 (12.0.0.alpha0 is outside it); 12.0.0 to 12.0.32 (12.0.33 is outside it); 12.1.0 to 12.1.6 (12.1.7 is outside it) - CVE-2025-11143: 9.4.0.v20161208 to 9.4.57.v20241219 (9.4.58.v20250814 is outside it); 10.0.0 to 10.0.26 (11.0.0-alpha0 is outside it); 11.0.0 to 11.0.26 (12.0.0.alpha0 is outside it); 12.0.0 to 12.0.30 (12.0.31 is outside it); 12.1.0 to 12.1.4 (12.1.5 is outside it) - CVE-2024-6763: 7.0.0.v20091005 to 12.0.11 (12.0.12 is outside it) - CVE-2023-40167: 9.0.0.v20130308 to 9.4.51.v20230217 (9.4.52.v20230823 is outside it); 10.0.0 to 10.0.15 (10.0.16 is outside it); 11.0.0 to 11.0.15 (11.0.16 is outside it); 12.0.0 (12.0.1 is outside it) - CVE-2022-2047: 7.0.0.M0 to 9.4.46.v20220331 (9.4.47.v20220610 is outside it); 10.0.0 to 10.0.9 (10.0.10 is outside it); 11.0.0 to 11.0.9 (11.0.10 is outside it) ## Advisories (5) ### [CVE-2026-2332](https://cve.now/CVE-2026-2332): HTTP Request Smuggling via Chunked Extension Quoted-String Parsing - Severity: High 7.4 - Published: Apr 14, 2026 - Affected: from 12.1.0, fixed in 12.1.7; from 12.0.0, fixed in 12.0.33; from 11.0.0, fixed in 11.0.29; from 10.0.0, fixed in 10.0.28; from 9.4.0, fixed in 9.4.60. - Fixed in 12.0.33 (released Mar 4, 2026, 41 days before disclosure, the advisory names 9.4.60, which was never published) and 12.1.7 (released Mar 4, 2026, 41 days before disclosure). - The latest release, 12.1.14, is not affected. ### [CVE-2025-11143](https://cve.now/CVE-2025-11143): The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. - Severity: Low 3.7 - Published: Mar 5, 2026 - Affected: from 9.4.0, through 9.4.58; from 10.0.0, through 10.0.26; from 11.0.0, through 11.0.26; from 12.0.0, fixed in 12.0.31; from 12.1.0, fixed in 12.1.5. - Fixed in 12.0.31 (released Dec 3, 2025, 92 days before disclosure) and 12.1.5 (released Dec 3, 2025, 92 days before disclosure). - The latest release, 12.1.14, is not affected. ### [CVE-2024-6763](https://cve.now/CVE-2024-6763): Jetty URI parsing of invalid authority - Severity: Low 3.7 - Published: Oct 14, 2024 - Affected: from 7.0.0, through 12.0.11; from 7.0.0, fixed in 12.0.12. - Fixed in 12.0.12 (released Jul 25, 2024, 81 days before disclosure). - The latest release, 12.1.14, is not affected. ### [CVE-2023-40167](https://cve.now/CVE-2023-40167): Jetty accepts "+" prefixed value in Content-Length - Severity: Medium 5.3 - Published: Sep 15, 2023 - Affected: from 9.0.0, fixed in 9.4.52; from 10.0.0, fixed in 10.0.16; from 11.0.0, fixed in 11.0.16; from 12.0.0, fixed in 12.0.1. - Fixed in 9.4.52.v20230823 (released Aug 23, 2023, 23 days before disclosure, the advisory names 9.4.52, which was never published), 10.0.16 (released Aug 25, 2023, 21 days before disclosure), 11.0.16 (released Aug 25, 2023, 21 days before disclosure) and 1 other version. - The latest release, 12.1.14, is not affected. ### [CVE-2022-2047](https://cve.now/CVE-2022-2047): In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment… - Severity: Low 2.7 - Published: Jul 7, 2022 - Affected: fixed in 9.4.47; from 10.0.0, fixed in 10.0.10; from 11.0.0, fixed in 11.0.10. - Fixed in 9.4.47.v20220610 (released Jun 10, 2022, 27 days before disclosure, the advisory names 9.4.47, which was never published), 10.0.10 (released Jun 16, 2022, 21 days before disclosure) and 11.0.10 (released Jun 16, 2022, 21 days before disclosure). - The latest release, 12.1.14, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.eclipse.jetty:jetty-http Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.