# Why does CVE-2024-22243 not apply to Jenkins?

**URL:** <https://community.jenkins.io/t/why-does-cve-2024-22243-not-apply-to-jenkins/17093>\
**Category:** Ask a question\
**Created:** [July 15, 2024, 7:25pm UTC](https://community.jenkins.io/t/why-does-cve-2024-22243-not-apply-to-jenkins/17093 "2024-07-15T19:25:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jsouthers](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@jsouthers](https://community.jenkins.io/u/jsouthers)\
**Post date:** [July 15, 2024, 7:25pm UTC](https://community.jenkins.io/t/why-does-cve-2024-22243-not-apply-to-jenkins/17093/1 "2024-07-15T19:25:18Z")

</div>

An auditor is questioning why CVE-2024-22243 does not apply to jenkins. Spring framework. can anyone provide more detail please?

---

<div class="post-metadata">

**Author:** ![basil](https://avatars.discourse-cdn.com/v4/letter/b/59ef9b/32.png) [@basil](https://community.jenkins.io/u/basil)\
**Post date:** [July 15, 2024, 8:22pm UTC](https://community.jenkins.io/t/why-does-cve-2024-22243-not-apply-to-jenkins/17093/2 "2024-07-15T20:22:13Z")

</div>

See [https://spring.io/security/cve-2024-22243](https://spring.io/security/cve-2024-22243). Jenkins has been shipping Spring 5.3.32 or later on the weekly release line since 2.446, on the 2.452.x LTS line since 2.452.1, and on the 2.440.x LTS line since 2.440.3.