Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.