CVE-2025-64134

Description

Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.

PUBLISHED Reserved 2025-10-28 | Published 2025-10-29 | Updated 2025-10-29 | Assigner jenkins

Product status

References

www.jenkins.io/security/advisory/2025-10-29/ (Jenkins Security Advisory 2025-10-29) vendor-advisory

cve.org (CVE-2025-64134)

nvd.nist.gov (CVE-2025-64134)

Download JSON