Partial Denial of Service in Oracle Java SE Libraries

Small 4-file proof-of-concept repository illustrating CVE-2026-22018 against Jenkins Pipeline shared libraries. The core idea is not a fully automated exploit tool but a minimal demonstration of unsafe pipeline behavior: the Jenkinsfile loads an untrusted shared library using @Library('evil-library@master'), and the README explains that a malicious library can use Groovy's @Grab annotation to fetch an external Maven artifact whose static initializer executes on the Jenkins controller during compilation/loading. Repository structure: Jenkinsfile contains the vulnerable pipeline pattern; README.md provides the vulnerability description, impact, exploitation concept, and mitigation guidance; exploit_jenkins_library.py is only a placeholder/commentary file and does not implement the exploit itself; LICENSE is standard metadata. Main exploit capability is controller-side arbitrary code execution via malicious dependency resolution in a shared library, making this primarily a supply-chain/code-injection issue in Jenkins pipeline configuration. No real network callback, shell, or hardcoded C2 is implemented in code; the only fingerprintable target-like values are the shared library identifier and the example Maven coordinate shown in documentation.