GHSA-9p56-p6mw-w8qc
High · 7.5CVSS
7.5
EPSS
—
Published
Dec 10, 2025
CISA due date
—
The record
Jenkins has a Denial of service vulnerability in HTTP-based CLI
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.jenkins-ci.main:cli | 0 | 2.528.3 |
| Maven | org.jenkins-ci.main:cli | 2.529 | 2.541 |
| Maven | org.jenkins-ci.main:jenkins-core | 0 | 2.528.3 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.529 | 2.541 |
| Bitnami | jenkins | 0 | 2.528.3 |
| Chainguard | jenkins-2.528 | 0 | 2.528.3-r2 |
| maven | org.jenkins-ci.main/cli | 2.529 | 2.541 |
| maven | org.jenkins-ci.main/jenkins-core | 2.529 | 2.541 |
Related vulnerabilities
- CVE-2025-67635 Jenkins has a Denial of service vulnerability in HTTP-based CLI Same vulnerability
- CVE-2015-8103 The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote… Also affects org.jenkins-ci.main:cli
- GHSA-85h6-5m3v-gx37 Jenkins has a stored XSS vulnerability in node offline cause description Also affects org.jenkins-ci.main:jenkins-core
- GHSA-wfhp-qgm8-5p5c Jenkins has a build information disclosure vulnerability through Run Parameter Also affects org.jenkins-ci.main:jenkins-core
- CVE-2026-27099 Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both… Also affects org.jenkins-ci.main:jenkins-core
- CVE-2026-27100 Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that… Also affects org.jenkins-ci.main:jenkins-core
- GHSA-6837-qgrc-x5p6 Jenkins has a CSRF vulnerability on the login form Also affects org.jenkins-ci.main:jenkins-core
- GHSA-fxj7-6v9w-xc76 Jenkins's build authorization token is stored and displayed in plain text Also affects org.jenkins-ci.main:jenkins-core