High-Severity Jenkins Flaws Risk Unauthenticated DoS via HTTP CLI and XSS Via Coverage Reports

The Jenkins security advisory highlights high‑severity flaws that could enable unauthenticated DoS via the HTTP‑based CLI and stored XSS through Coverage Reports, potentially affecting CI/CD pipelines. The bundle’s most severe entry, CVE‑2025‑67635, targets the core HTTP CLI in versions 2.540 and earlier, stemming from improper connection handling that can leave request‑handling threads waiting indefinitely.

The Coverage Plugin flaw, CVE‑2025‑67641, allows XSS when attackers with Item/Configure permissions abuse coverage reports, with a fix implemented in version 2.3056.v1dfe888b_0249 that validates result identifiers more strictly. The advisory also notes mitigations such as Encrypting build tokens (CVE‑2025‑67637) and enforcing stricter View/Configure permissions to redact passwords (CVE‑2025‑67636), while a separate issue in the HashiCorp Vault Plugin (CVE‑2025‑67642) remains open.

To address the risks, admins are advised to upgrade Jenkins core to 2.541 or LTS 2.528.3 and update plugins such as Git Client (to 6.4.1) and BlazeMeter (to 4.27). As of publication, there is no fix for the Vault plugin vulnerability, so close monitoring of configurations is recommended.