Package
jenkins-2.504-openjdk-17
Component
jetty-http2-common
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The vulnerable Jetty dependency is bundled via Winstone, which Jenkins uses as its embedded servlet container. Since Winstone 8.10 currently ships with Jetty 12.0.22, we can’t upgrade Jetty directly in Jenkins — it must be updated upstream in Winstone. Once upstream updates Winstone to use Jetty 12.0.25 (the patched version), Jenkins can pull it in, and we’ll be able to remediate the CVE. [v2-migration]
Status
Status
Impact
The vulnerable Jetty dependency is bundled via Winstone, which Jenkins uses as its embedded servlet container. Since Winstone 8.10 currently ships with Jetty 12.0.22, we can’t upgrade Jetty directly in Jenkins — it must be updated upstream in Winstone. Once upstream updates Winstone to use Jetty 12.0.25 (the patched version), Jenkins can pull it in, and we’ll be able to remediate the CVE.
Status