6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2021-21607

GHSA ID

GHSA-cxqw-vjcr-gp5g

EPSS Score

0.49559%

CWE

CWE-770

Published

5/24/2022

Updated

12/14/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2021-21607

CVE-2021-21607: Excessive memory allocation in graph URLs leads to denial of service in Jenkins

Jenkins renders several different graphs for features like agent and label usage statistics, memory usage, or various plugin-provided statistics.

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit the graph size provided as query parameters.

This allows attackers to request or to have legitimate Jenkins users request crafted URLs that rapidly use all available memory in Jenkins, potentially leading to out of memory errors.

Jenkins 2.275, LTS 2.263.2 limits the maximum size of graphs to an area of 10 million pixels. If a larger size is requested, the default size for the graph will be rendered instead.

This threshold can be configured by setting the Java system property hudson.util.Graph.maxArea to a different number on startup.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2021-21607

CVE-2021-21607:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2021-21607

GHSA ID

GHSA-cxqw-vjcr-gp5g

EPSS Score

0.49559%

CWE

CWE-770

Published

5/24/2022

Updated

12/14/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.main:jenkins-core	maven	<= 2.263.1	2.263.2
org.jenkins-ci.main:jenkins-core	maven	>= 2.264, <= 2.274	2.275

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from unvalidated graph dimensions in graph rendering. The pre-patch code in Graph.java's render method directly parsed 'w' and 'h' parameters from the request (via Integer.parseInt(w)/Integer.parseInt(h)) and passed them to JFreeChart's createBufferedImage. This allowed attackers to specify arbitrary large values for graph dimensions. The commit added MAX_AREA validation and safeDimension checks, confirming the vulnerability was in the original rendering path that lacked these protections.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2021-21607: Excessive memory allocation in graph URLs leads to denial of service in Jenkins

CVE-2021-21607:

6.5

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

6.5

6.5

CVE-2021-21607: Excessive memory allocation in graph URLs leads to denial of service in Jenkins

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI