CGA-fpvf-w8mc-qjjm

The vulnerable Jetty dependency is bundled via Winstone, which Jenkins uses as its embedded servlet container. Since Winstone 8.10 currently ships with Jetty 12.0.22, we can’t upgrade Jetty directly in Jenkins — it must be updated upstream in Winstone. Once upstream updates Winstone to use Jetty 12.0.25 (the patched version), Jenkins can pull it in, and we’ll be able to remediate the CVE.