HIGH 7.5 Maven
Jenkins has a Denial of service vulnerability in HTTP-based CLI
GHSA-9p56-p6mw-w8qc · BIT-jenkins-2025-67635 · CVE-2025-67635
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-67635
- WEB https://github.com/jenkinsci/jenkins/commit/efa1816322026f2b9235a27eee814bcc7ba0a764
- WEB https://fluidattacks.com/blog/unauth-dos-in-jenkins-cli
- PACKAGE https://github.com/jenkinsci/jenkins
- WEB https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3630
Ready to move
Start Securing
Free, no credit card | First findings in minutes