CVE-2025-67635
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenti…
Published Dec 10, 2025 · updated Oct 14, 2026 · jenkins jenkins
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
Timeline
Detection, updates, and resolution for this record.
Dec 10, 2025 · NIST NVD
Detected
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
Oct 14, 2026 · NIST NVD
Updated
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
Affected
- cpe jenkins/jenkinsversion unspecified
Sources
- CVE.orgCVE-2025-67635
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-67635
30-day exploitation probability 0.6%
first.org - NIST NVDCVE-2025-67635
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
nvd.nist.gov