CVE-2019-16549: Jenkins Maven

High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days.

Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents.

Affected products

• Jenkins Maven: up to and including 0.16.1

Published 2019-12-17. Last modified 2026-06-17.