CVE-2022-43411: Jenkins GitLab

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.

Affected products

• Jenkins GitLab: before 1.5.36 (fixed in 1.5.36)

Published 2022-10-19. Last modified 2026-06-17.