# Patching : Reported vulnerabilities in latest version **URL:** \ **Category:** Ask a question\ **Created:** [September 9, 2026, 4:08pm UTC](https://community.jenkins.io/t/patching-reported-vulnerabilities-in-latest-version/37267 "2026-09-09T16:08:33Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Tadgh](https://avatars.discourse-cdn.com/v4/letter/t/9f8e36/32.png) [@Tadgh](https://community.jenkins.io/u/Tadgh)\ **Post date:** [September 9, 2026, 4:08pm UTC](https://community.jenkins.io/t/patching-reported-vulnerabilities-in-latest-version/37267/1 "2026-09-09T16:08:33Z")
We are currently running Jenkins 2.568.3 LTS. Our vulnerability scanning has identified vulnerabilities in the Eclipse Jetty version bundled with Jenkins and recommends upgrading to Jetty 12.1.13 or later. We understand that Jetty is provided through Jenkins/Winstone and therefore do not intend to replace the Jetty libraries manually. Could someone confirm whether an upgrade to Jetty 12.1.13 is currently planned or being tracked in Winstone/Jenkins? In particular: 1. Is there an existing Winstone/Jenkins issue or PR tracking Jetty 12.1.13? 2. Which Jenkins release is expected to contain Jetty 12.1.13 or later? 3. Is the update expected to be included in the next Jenkins LTS release? 4. Is there a recommended remediation for Jenkins LTS users in the meantime? We would prefer to remain on the Jenkins LTS release line rather than move our production controller to a weekly build. Thanks. ---
**Author:** ![mawinter69](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/mawinter69/32/1625_2.png) [@mawinter69](https://community.jenkins.io/u/mawinter69)\ **Post date:** [September 9, 2026, 8:59pm UTC](https://community.jenkins.io/t/patching-reported-vulnerabilities-in-latest-version/37267/2 "2026-09-09T20:59:06Z")
The next LTS 2.580.1, planned for Sep 30th, will contain latest Winstone [Release 8.1050.veb\_a\_0d2124285 · jenkinsci/winstone · GitHub](https://github.com/jenkinsci/winstone/releases/tag/8.1050.veb_a_0d2124285) that uses Jetty 12.1.13 ---
**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\ **Post date:** [September 10, 2026, 11:04am UTC](https://community.jenkins.io/t/patching-reported-vulnerabilities-in-latest-version/37267/3 "2026-09-10T11:04:02Z")
A [Jenkins 2.580.1 pre-release](https://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.580.1-rc) with Jetty 12.1.13 is available for you to test now. Please report results from your testing of the pre-release here (in this thread) or in the [release candidate announcement thread](https://groups.google.com/g/jenkinsci-dev/c/UDpOLWjZinQ). ---
**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\ **Post date:** [September 10, 2026, 11:20am UTC](https://community.jenkins.io/t/patching-reported-vulnerabilities-in-latest-version/37267/4 "2026-09-10T11:20:52Z")
> [@Tadgh](#): > > In particular: > > 1. Is there an existing Winstone/Jenkins issue or PR tracking Jetty 12.1.13? - [Winstone 8.1050](https://github.com/jenkinsci/jenkins/pull/27357) - [Backport Winstone 8.1050 to Jenkins 2.580.1](https://github.com/jenkinsci/jenkins/pull/27359) > [@Tadgh](#): > > 1. Which Jenkins release is expected to contain Jetty 12.1.13 or later? Jenkins weekly 2.581 and Jenkins LTS 2.580.1 > [@Tadgh](#): > > 1. Is the update expected to be included in the next Jenkins LTS release? Yes > [@Tadgh](#): > > 1. Is there a recommended remediation for Jenkins LTS users in the meantime? I’m not aware of any vulnerability in Jetty 12.1.12 that would need remediation. Please provide the CVE identifier for the issue. I doubt that it affects Jenkins, but without the CVE identifier, there is no way to know for sure. ---
**Author:** ![Tadgh](https://avatars.discourse-cdn.com/v4/letter/t/9f8e36/32.png) [@Tadgh](https://community.jenkins.io/u/Tadgh)\ **Post date:** [September 10, 2026, 11:29am UTC](https://community.jenkins.io/t/patching-reported-vulnerabilities-in-latest-version/37267/5 "2026-09-10T11:29:04Z")
This was detected by Microsoft rather than Tenable. **CVE-2026-19204** — WebSocket frames with unknown opcodes and huge declared payload lengths can exhaust the JVM heap; published 7 September 2026, CVSS 8.7 > **[CVE-2026-19204](https://www.tenable.com/cve/CVE-2026-19204)** > > A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown... High – CVSSv3 score = 7.5 **CVE-2026-19203** — HTTP request smuggling via lone LF terminators in chunked request parsing; published 8 September 2026, CVSS 8.3 > **[CVE-2026-19203](https://www.tenable.com/cve/CVE-2026-19203)** > > A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting... High – CVSSv3 score = 7.5 ---
**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\ **Post date:** [September 10, 2026, 11:51am UTC](https://community.jenkins.io/t/patching-reported-vulnerabilities-in-latest-version/37267/6 "2026-09-10T11:51:02Z")
> [@Tadgh](#): > > This was detected by Microsoft rather than Tenable. As far as I can tell from the NVD and Mitre pages for those issues, they are resolved in Jetty 12.1.12 and later. [Jenkins 2.568.3](https://www.jenkins.io/changelog/2.568.3/) includes Jetty 12.1.12. - CVE-2026-19203 - [Mitre](https://www.cve.org/CVERecord?id=CVE-2026-19203), [NVD](https://nvd.nist.gov/vuln/detail/cve-2026-19203) - CVE-2026-19204 - [Mitre](https://www.cve.org/CVERecord?id=CVE-2026-19204), [NVD](https://nvd.nist.gov/vuln/detail/cve-2026-19204) ---
**Author:** ![Tadgh](https://avatars.discourse-cdn.com/v4/letter/t/9f8e36/32.png) [@Tadgh](https://community.jenkins.io/u/Tadgh)\ **Post date:** [September 10, 2026, 12:27pm UTC](https://community.jenkins.io/t/patching-reported-vulnerabilities-in-latest-version/37267/7 "2026-09-10T12:27:15Z")
Thank you And when are these being added to LTR? ---
**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\ **Post date:** [September 10, 2026, 12:32pm UTC](https://community.jenkins.io/t/patching-reported-vulnerabilities-in-latest-version/37267/8 "2026-09-10T12:32:25Z")
> [@Tadgh](#): > > And when are these being added to LTR? What is “LTR”? I don’t understand the question. ---
**Author:** ![Tadgh](https://avatars.discourse-cdn.com/v4/letter/t/9f8e36/32.png) [@Tadgh](https://community.jenkins.io/u/Tadgh)\ **Post date:** [September 10, 2026, 12:53pm UTC](https://community.jenkins.io/t/patching-reported-vulnerabilities-in-latest-version/37267/9 "2026-09-10T12:53:40Z")
Apologies i meant LTS - long term release We are currently on Jenkins 2.568.3 LTS and im wondering when these CVEs will be patched please? Thanks ---
**Author:** ![mawinter69](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/mawinter69/32/1625_2.png) [@mawinter69](https://community.jenkins.io/u/mawinter69)\ **Post date:** [September 10, 2026, 1:08pm UTC](https://community.jenkins.io/t/patching-reported-vulnerabilities-in-latest-version/37267/10 "2026-09-10T13:08:12Z")
Both CVEs are patched in Jetty 12.1.12 which is used in 2.568.3 so there is nothing to patch. ---
**Author:** ![Tadgh](https://avatars.discourse-cdn.com/v4/letter/t/9f8e36/32.png) [@Tadgh](https://community.jenkins.io/u/Tadgh)\ **Post date:** [September 10, 2026, 2:13pm UTC](https://community.jenkins.io/t/patching-reported-vulnerabilities-in-latest-version/37267/11 "2026-09-10T14:13:04Z")
> [@mawinter69](#): > > CVEs are patched in Jetty 12.1.12 which is used in 2.568.3 so there is nothing to patch IS this one already patched too ? **CVE-2026-12611** — HTTP/2 race condition with RST\_STREAM/GOAWAY frames that blocks all threads and hangs the server; published 8 September 2026, CVSS 8.7 > **[CVE-2026-12611](https://www.tenable.com/cve/CVE-2026-12611)** > > A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server... High – CVSSv3 score = 5.9 Tenable said they werent but i can push back as they often get things wrong ---
**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\ **Post date:** [September 10, 2026, 2:20pm UTC](https://community.jenkins.io/t/patching-reported-vulnerabilities-in-latest-version/37267/12 "2026-09-10T14:20:56Z")
> [@Tadgh](#): > > IS this one already patched too ? > > **CVE-2026-12611** — HTTP/2 race condition with RST\_STREAM/GOAWAY frames that blocks all threads and hangs the server; published 8 September 2026, CVSS 8.7 It is frustrating to read the [Mitre](https://www.cve.org/CVERecord?id=CVE-2026-12611) and [NVD pages](https://nvd.nist.gov/vuln/detail/cve-2026-12611) for you. Please read them yourself. Both pages say that CVE-2026-12611 applies to Jetty 12.1.0 to 12.1.10. Since Jenkins 2.568.3 includes Jetty 12.1.12, it is not affected by that CVE.