Jira mail resolver causes thread leak and OutOfMemoryError on authentication failure

Issue

When the Jira plugin plugin is installed and an authentication failure occurs (invalid credentials, expired API token, or an automated API poller with stale credentials), the managed controller leaks one OS-level reactor thread per failure. Over time the accumulated threads exhaust the container’s thread/PID limit, causing subsequent login attempts to fail with:

java.lang.OutOfMemoryError: unable to create native thread: possibly out of memory or process/resource limits reached
  at java.lang.Thread.start0(Native Method)
  at java.lang.Thread.start(Thread.java:1526)
  at hudson.model.AsyncPeriodicWork.doRun(AsyncPeriodicWork.java:129)▼

The following stack trace in thread dumps identifies this specific leak:

at hudson.plugins.jira.JiraRestService.getUser(JiraRestService.java:408)
at hudson.plugins.jira.JiraMailAddressResolver.findMailAddressFor(JiraMailAddressResolver.java:51)
at com.cloudbees.jenkins.plugins.data.events.SecurityListenerRelay.failedToAuthenticate
at jenkins.security.SecurityListener.fireFailedToAuthenticate
at hudson.security.AbstractPasswordBasedSecurityRealm.doAuthenticate▼

Environment

Related Issue(s)

JENKINS-50161

Resolution

Upgrade to CloudBees CI on modern cloud platforms version 2.332.1.4 or newer to resolve this issue.

Workaround

If upgrading is not immediately possible:

Set the following JVM argument on the managed controller:
```
-Dhudson.plugins.jira.JiraMailAddressResolver.disabled=true
```
For instructions on setting JVM arguments, see How to add Java arguments to Jenkins (CloudBees CI on traditional platforms) or How to add Java arguments to Jenkins on CI Modern (CloudBees CI on modern cloud platforms managed controllers).
Restart the managed controller pod to clear any accumulated leaked threads and pick up the new flag.
Verify the argument is active by navigating to Manage Jenkins System Information System Properties and confirming -Dhudson.plugins.jira.JiraMailAddressResolver.disabled=true is listed.

This workaround disables email address resolution via Jira for all users. If Jira-based email lookup is required for other workflows, consider reducing authentication failures by auditing and rotating stale API tokens used by automated pollers or integrations against the managed controller.

References

This article is part of our Knowledge Base and is provided for guidance-based purposes only. The solutions or workarounds described here are not officially supported by CloudBees and may not be applicable in all environments. Use at your own discretion, and test changes in a safe environment before applying them to production systems.