Improper resource shutdown or release in Jenkins and Jenkins LTS - CVE-2025-67635

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU119837

Improper resource shutdown or release in Jenkins and Jenkins LTS - CVE-2025-67635

Published: December 11, 2025


Vulnerability identifier: #VU119837
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-67635
CWE-ID: CWE-404
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the affected application does not properly close HTTP-based CLI connections when the connection stream becomes corrupted. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.


Affected software

Jenkins
Jenkins LTS
OpenShift Developer Tools and Services
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Service Communication Proxy

How to mitigate CVE-2025-67635

Install updates from vendor's website.

Jenkins - update to 2.541
Jenkins LTS - update to 2.528.3

External References

Related Security Bulletins