CVE-2025-67635

HIGH

Jenkins < 2.528.3 and 2.529-2.540 - Unauthenticated Denial of Service via HTTP CLI Connection Handling

Title source: llm

Description

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3630

Scores

CVSS v3 7.5

EPSS 0.0051

EPSS Percentile 39.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-404

Status published

Products (4)

jenkins/jenkins < 2.528.3

jenkins/jenkins < 2.541

org.jenkins-ci.main/cli 2.529 - 2.541Maven

org.jenkins-ci.main/jenkins-core 2.529 - 2.541Maven

Published Dec 10, 2025

Tracked Since Feb 18, 2026