Report feedback

When Jenkins is run via java -jar jenkins.war, an unauthenticated remote attacker can carry out a DoS attack. Only instances with HTTP/2 enabled are affected [1].

The vulnerability is present in products:

• *:Jenkins weekly; <=2.523
• *:Jenkins LTS; <=2.516.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-5115 at cve.org, NVD
• CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org

The vulnerability was publicly disclosed 17. 9. 2025.

Due to a missing permission check in the page sidebar, an unauthenticated remote attacker without Overall/Read permission can list agent names using the "Executors" widget [1].

The vulnerability is present in products:

• *:Jenkins weekly; <=2.527
• *:Jenkins LTS; <=2.516.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

More information:

• CVE-2025-59474 at cve.org, NVD
• CWE-862: Missing Authorization at cwe.mitre.org

The vulnerability was publicly disclosed 17. 9. 2025.

Due to a missing permission check in the user profile menu, an authenticated remote attacker without Overall/Read permission can obtain limited configuration information [1].

The vulnerability is present in products:

• *:Jenkins weekly; <=2.527
• *:Jenkins LTS; <=2.516.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

More information:

• CVE-2025-59475 at cve.org, NVD
• CWE-862: Missing Authorization at cwe.mitre.org

The vulnerability was publicly disclosed 17. 9. 2025.

Due to missing restriction of characters in log formatting, an unauthenticated remote attacker can insert line break characters into logs and subsequently forge log messages [1].

The vulnerability is present in products:

• *:Jenkins weekly; <=2.527
• *:Jenkins LTS; <=2.516.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

More information:

• CVE-2025-59476 at cve.org, NVD
• CWE-117: Improper Output Neutralization for Logs at cwe.mitre.org

The vulnerability was publicly disclosed 17. 9. 2025.