Read the docs
TI-2019-15856 Aliases CVE-2019-1003011GHSA-23h9-m55m-c5jp

Uncontrolled recursion in Jenkins Token Macro Plugin

Priority LOW 39CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
High · None · High
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.

Summary

An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.

Why it matters now

EPSS 0.02039 81st percentileScored 2026-11-07
Fix Partial org.jenkins-ci.plugins:token-macro (Maven): 2.6Red Hat: 1 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Token Macro Pluginup to 2.5—No fix listedCNA
—org.jenkins-ci.plugins:token-macro (Maven)before 2.62.6Patch availableGHSA-23h9-m55m-c5jp
  • Jenkins Token Macro Plugin VendorJenkins Affected up to 2.5 Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:token-macro (Maven) Vendor— Affected before 2.6 Fixed in 2.6 Patch available GHSA-23h9-m55m-c5jp

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:token_macro:*:*:*:*:*:jenkins:*:*up to 2.5VulnerableJenkins
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*3.11VulnerableRed Hat
  • cpe:2.3:a:jenkins:token_macro:*:*:*:*:*:jenkins:*:* Versions up to 2.5 Vulnerable ·Jenkins
  • cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-23h9-m55m-c5jp org.jenkins-ci.plugins:token-macro (Maven) Fixed in 2.6 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.10AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.6AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.7AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.9AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 3.11Fixed—

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1003011
  2. 2026-10-03 Alias added: GHSA-23h9-m55m-c5jp

References

Advisory 4

Other 1

  • TI-2019-07646 XML external entity injection in Jenkins Token Macro Plugin CVSS 3.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences