Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.
{ "severity": "Medium", "cpes": [ "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*", "cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*" ] }