CVE-2025-64135
Jenkins Eggplant Runner Plugin protection mechanism disabled
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value, disabling a protection mechanism of the Java runtime.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value, disabling a protection mechanism of the Java runtime.
- Record
CVE-2025-64135- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
EUVDEUVD-2025-36648
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value, disabling a protection mechanism of the Java runtime.
- Record
EUVD-2025-36648- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w5r3-gr8w-7fj5
Jenkins Eggplant Runner Plugin protection mechanism disabled
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value as part of applying a proxy configuration.
This disables a protection mechanism of the Java runtime addressing CVE-2016-5597.
As of publication of this advisory, there is no fix.
- Record
GHSA-w5r3-gr8w-7fj5- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
NVD
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value, disabling a protection mechanism of the Java runtime.
- Record
CVE-2025-64135- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
OSVGHSA-w5r3-gr8w-7fj5
Jenkins Eggplant Runner Plugin protection mechanism disabled
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value as part of applying a proxy configuration.
This disables a protection mechanism of the Java runtime addressing CVE-2016-5597.
As of publication of this advisory, there is no fix.
- Record
GHSA-w5r3-gr8w-7fj5- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-1188
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.jenkins.plugins:eggplant-runnerMaven |
through 0.0.1.301.v963cffe8ddb | None known |
io.jenkins.plugins:eggplant-runnerMaven |
through 0.0.1.301.v963cffe8ddb, plus listed versions 0.0.1.104.v6a_2d3791d2890.0.1.108.v32f1564b_19d00.0.1.159.v8ed1d9f67f000.0.1.17.v1579c75fa_1440.0.1.185.v9617008ee458 Show 28 moreShow less0.0.1.189.v1e3397db_cee80.0.1.191.v72dea_07931b_60.0.1.22.v5e23a_10537ed0.0.1.226.v1a_ff670357750.0.1.247.va_7031a_5862980.0.1.252.v8e47de80211e0.0.1.255.vd38258d75ca_60.0.1.259.va_548428d4b_790.0.1.261.v52442e5f85140.0.1.265.v56273b_eece560.0.1.270.vcb_9192a_2c0040.0.1.272.vb_d90814253670.0.1.274.ve12295250d730.0.1.278.ve95892534fd10.0.1.279.vd472e8e0965d0.0.1.280.vfc393dfee9f10.0.1.284.va_b_a_6107c05150.0.1.285.v30ff1ea_cd5330.0.1.300.v6280c46cd6700.0.1.34.vb_8a_19b_008b_350.0.1.38.vdc88180eb_3f40.0.1.42.vc410c4e864e60.0.1.51.vdb_9cc3a_888280.0.1.57.v2b_a_a_c5a_e82db_0.0.1.59.v14e07b_c807520.0.1.78.va_45a_c4d435570.0.1.80.vf3e498a_e29950.0.1.85.vfb_43a_f521988 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-64135 is a medium vulnerability (CVSS 5.9) in Jenkins Eggplant Runner, published October 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. No source names a fixed version.