Package
jenkins-2.568-openjdk-25
Component
commons-lang
Latest update
5.3
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The vulnerable copy is commons-lang 2.6, shipped inside the bundled web archive and declared directly in the upstream build's dependency management, where the maintained commons-lang3 artifact is explicitly excluded from the archive. GHSA-j288-q9x7-2f5v has no patched release in the commons-lang 2.x line, which ended at 2.6 and is no longer maintained; the fix exists only in the separate commons-lang3 3.18.0 artifact under a different package root, so no version bump is possible. The library also cannot simply be removed, because core classes link against org.apache.commons.lang at runtime. Resolution requires the upstream project to complete its migration from commons-lang 2.x to commons-lang3, tracked in jenkinsci/jenkins#26105 and JENKINS-72981, which remains open.
Status