Patching : Reported vulnerabilities in latest version

Using Jenkins Ask a question
1

We are currently running Jenkins 2.568.3 LTS.
Our vulnerability scanning has identified vulnerabilities in the Eclipse Jetty version bundled with Jenkins and recommends upgrading to Jetty 12.1.13 or later.
We understand that Jetty is provided through Jenkins/Winstone and therefore do not intend to replace the Jetty libraries manually.
Could someone confirm whether an upgrade to Jetty 12.1.13 is currently planned or being tracked in Winstone/Jenkins?
In particular:

  1. Is there an existing Winstone/Jenkins issue or PR tracking Jetty 12.1.13?
  2. Which Jenkins release is expected to contain Jetty 12.1.13 or later?
  3. Is the update expected to be included in the next Jenkins LTS release?
  4. Is there a recommended remediation for Jenkins LTS users in the meantime?
    We would prefer to remain on the Jenkins LTS release line rather than move our production controller to a weekly build.
    Thanks.
2

The next LTS 2.580.1, planned for Sep 30th, will contain latest Winstone Release 8.1050.veb_a_0d2124285 · jenkinsci/winstone · GitHub that uses Jetty 12.1.13

3

A Jenkins 2.580.1 pre-release with Jetty 12.1.13 is available for you to test now. Please report results from your testing of the pre-release here (in this thread) or in the release candidate announcement thread.

4

Jenkins weekly 2.581 and Jenkins LTS 2.580.1

Yes

I’m not aware of any vulnerability in Jetty 12.1.12 that would need remediation. Please provide the CVE identifier for the issue. I doubt that it affects Jenkins, but without the CVE identifier, there is no way to know for sure.

5

This was detected by Microsoft rather than Tenable.

CVE-2026-19204 — WebSocket frames with unknown opcodes and huge declared payload lengths can exhaust the JVM heap; published 7 September 2026, CVSS 8.7

High – CVSSv3 score = 7.5

CVE-2026-19203 — HTTP request smuggling via lone LF terminators in chunked request parsing; published 8 September 2026, CVSS 8.3

High – CVSSv3 score = 7.5

6

As far as I can tell from the NVD and Mitre pages for those issues, they are resolved in Jetty 12.1.12 and later. Jenkins 2.568.3 includes Jetty 12.1.12.

7

Thank you

And when are these being added to LTR?

8

What is “LTR”? I don’t understand the question.

9

Apologies i meant LTS - long term release

We are currently on Jenkins 2.568.3 LTS and im wondering when these CVEs will be patched please?

Thanks

10

Both CVEs are patched in Jetty 12.1.12 which is used in 2.568.3 so there is nothing to patch.

11

IS this one already patched too ?

CVE-2026-12611 — HTTP/2 race condition with RST_STREAM/GOAWAY frames that blocks all threads and hangs the server; published 8 September 2026, CVSS 8.7

High – CVSSv3 score = 5.9

Tenable said they werent but i can push back as they often get things wrong

12

It is frustrating to read the Mitre and NVD pages for you. Please read them yourself.

Both pages say that CVE-2026-12611 applies to Jetty 12.1.0 to 12.1.10. Since Jenkins 2.568.3 includes Jetty 12.1.12, it is not affected by that CVE.