Deserialization of Untrusted Data in Jenkins

published 2018-08-23 8 y ago modified 2026-06-17 4 mo ago also GHSA-28p3-mchr-9frj , EUVD-2022-1940

cvss: 5.3; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 73%
public exploits: 0; none known

A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.

Patch / fix

fixed in 1 links 1

maven org.jenkins-ci.main:jenkins-core 2.121.3, 2.138

github.com/jenkinsci/jenkins@727d58f commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1999042 updated 2025-11-21 cvss 4.3

jenkins: Deserialization of URL objects with host components

Red Hat OpenShift Container Platform 3.2 jenkins Red Hat OpenShift Container Platform 3.3 jenkins Red Hat OpenShift Container Platform 3.4 jenkins Red Hat OpenShift Container Platform 3.5 jenkins Red Hat OpenShift Container Platform 3.6 jenkins Red Hat OpenShift Container Platform 3.7 jenkins

+3 more productsfewer

Red Hat OpenShift Container Platform 3.9 jenkins Red Hat OpenShift Container Platform 3.10 jenkins Red Hat OpenShift Enterprise 3.1 jenkins

affected: no fix planned “Will not fix”
Red Hat OpenShift Container Platform 3.11 jenkins
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.46% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub	3.0	5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.jenkins-ci.main:jenkins-core	<2.121.3 >=2.122, <2.138	2.121.3 2.138

Classification

Weakness

CWE-502 Deserialization of Untrusted Data

Technology feeds

Jenkins rss critical rss

References

github.com /jenkinsci/jenkins/commit/727d58f690abf64f543407e1de3545eca76ad30e
web
jenkins.io /security/advisory/2018-08-15/#SECURITY-637
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2018-1999042
advisory
github.com /jenkinsci/jenkins
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary