Jenkins has a Denial of service vulnerability in HTTP-based CLI

HIGH 7.5CVE-2025-67635 · BIT-jenkins-2025-67635 · GHSA-9p56-p6mw-w8qc · Published 10/12/2025 · updated 14/10/2026

In short

CVE-2025-67635 is a HIGH (CVSS 7.5) vulnerability affecting org.jenkins-ci.main:cli, org.jenkins-ci.main:jenkins-core, jenkins (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.56%, higher than 46.8% of all vulnerabilities.
Fix: update to 2.541, 2.528.3 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.main:cli Maven	`≥ 2.529, < 2.541< 2.528.3`	`2.5412.528.3`
org.jenkins-ci.main:jenkins-core Maven	`≥ 2.529, < 2.541< 2.528.3`	`2.5412.528.3`
jenkins jenkins	`< 2.528.3< 2.541`	`2.528.32.541`

Description

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-67635 · ADVISORY
jenkinsci/jenkins commit efa1816 · WEB
fluidattacks.com/blog/unauth-dos-in-jenkins-cli · WEB
jenkinsci/jenkins · PACKAGE
jenkins.io/security/advisory/2025-12-10 · WEB

More vulnerabilities in org.jenkins-ci.main:cli

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.main:cli

Maven

≥ 2.529, < 2.541< 2.528.3

2.5412.528.3

org.jenkins-ci.main:jenkins-core

Maven

≥ 2.529, < 2.541< 2.528.3

2.5412.528.3

jenkins

< 2.528.3< 2.541

2.528.32.541

Description

NVD description