Jython bundles a bunch of external libs, many of which are rather old versions. The Netty used by the Jython dependency has two vulnerabilities related to it.
So, the entire Jython is red-flagged with CVSS 6.5 CVE vulnerability.

Please update to the latest version in 2.7.5.