CGA-5c65-2h4x-pxxh

The vulnerable Jetty dependency is bundled via Winstone, which Jenkins uses as its embedded servlet container. Since Winstone currently ships with Jetty 10.0.20, we can’t upgrade Jetty directly in Jenkins — it must be updated upstream in Winstone. Once upstream updates Winstone to use Jetty 10.0.26 (the patched version), Jenkins can pull it in, and we’ll be able to remediate the CVE.