CVE-2022-0538: Jenkins

High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days.

Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.

Affected products

• Jenkins Jenkins: before 2.319.3 (fixed in 2.319.3); before 2.334 (fixed in 2.334)

Published 2022-02-09. Last modified 2026-06-17.