CVE-2025-64135: Medium severity Jenkins Eggplant Runner Plugin vulnerability
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb8 and earlier sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value as part of applying a proxy configuration.
This disables a protection mechanism of the Java runtime addressing CVE-2016-5597.
As of publication of this advisory, there is no fix.
Other sources
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb8 and earlier sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value, disabling a protection mechanism of the Java runtime.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64135?
The severity of CVE-2025-64135 has not been classified yet, but it poses a significant risk due to disabling a protection mechanism in the Java runtime.
How do I fix CVE-2025-64135?
To fix CVE-2025-64135, update the Jenkins Eggplant Runner Plugin to a version later than 0.0.1.301.v963cffe8ddb_8.
What impact does CVE-2025-64135 have on my system?
CVE-2025-64135 can expose your system to unauthorized access and potential attacks by disabling tunneling protections in Java.
Is my version of Jenkins Eggplant Runner Plugin vulnerable to CVE-2025-64135?
If you are using Jenkins Eggplant Runner Plugin version 0.0.1.301.v963cffe8ddb_8 or earlier, your version is vulnerable to CVE-2025-64135.
Can CVE-2025-64135 be exploited remotely?
Yes, CVE-2025-64135 can potentially be exploited remotely, which increases the urgency for remediation.