7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67635

CVE-2025-67635: Jenkins has a Denial of service vulnerability in HTTP-based CLI

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67635

CVE-2025-67635:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.main:jenkins-core	maven	>= 2.529, < 2.541	2.541
org.jenkins-ci.main:cli	maven	>= 2.529, < 2.541	2.541
org.jenkins-ci.main:jenkins-core	maven	< 2.528.3	2.528.3
org.jenkins-ci.main:cli	maven	< 2.528.3	2.528.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial of service in the Jenkins HTTP-based CLI, caused by two distinct but related issues. First, in hudson.cli.PlainCLIProtocol.run, network connections were not being closed properly in all error conditions, leading to a resource leak (CWE-404). The fix was to move the connection closing logic into a finally block to guarantee its execution. Second, in hudson.cli.CLIAction$HttpCliEndpoint.run and jenkins.util.FullDuplexHttpService.upload, the code used unbounded wait() calls while waiting for client activity. This allowed a malicious client to initiate a connection and then do nothing, causing the server threads to hang indefinitely. This would eventually exhaust the server's thread pool, making it unable to service legitimate requests. The patch mitigates this by replacing the indefinite waits with timed waits. An attacker could exploit this by creating multiple connections that trigger these hanging threads or error conditions, consuming server resources until it becomes unresponsive.

Vulnerable functions

hudson.cli.PlainCLIProtocol.run

cli/src/main/java/hudson/cli/PlainCLIProtocol.java

The original code only closed the connection (`side.handleClose()`) for specific exceptions. If another type of IOException or a RuntimeException occurred, the connection would not be closed, leading to a resource leak. The patch moves `side.handleClose()` to a `finally` block to ensure it is always executed, thus preventing the leak.

hudson.cli.CLIAction$HttpCliEndpoint.run

core/src/main/java/hudson/cli/CLIAction.java

This method contained an unbounded `wait()`, causing the thread to wait indefinitely for a client to become 'ready'. An attacker could initiate a connection and never send the required data, causing the server thread to hang forever. This would consume a thread from the server's pool, eventually leading to thread exhaustion and a denial of service. The patch replaces the indefinite wait with a timed wait.

jenkins.util.FullDuplexHttpService.upload

core/src/main/java/jenkins/util/FullDuplexHttpService.java

Similar to the vulnerability in `CLIAction`, this method had an unbounded `wait()` while waiting for an upload to complete. An attacker could start an upload and never send the data, causing the server thread to wait indefinitely. This leads to thread exhaustion and a denial of service. The patch introduces a timeout to the wait loop.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.