Jenkins Patches High-Severity Vulnerabilities, Including a DoS Flaw

Jenkins has released a security advisory addressing multiple high- and medium-severity flaws that could enable denial-of-service, unauthorized data access, or log manipulation in both weekly and Long-Term Support (LTS) releases. The most severe issue is HTTP/2 Denial of Service, CVE-2025-5115, in the bundled Jetty server, which affects Jenkins 2.523 and earlier and LTS 2.516.2 and earlier, unless HTTP/2 is disabled; administrators are urged to upgrade to Jenkins 2.524 or LTS 2.516.3, which bundle Jetty 12.0.25.

Missing permission checks in CVE-2025-59474 and CVE-2025-59475 could allow attackers without Overall/Read permission to enumerate agents or view limited configuration details, with fixes in Jenkins 2.528 and LTS 2.516.3. A third flaw, CVE-2025-59476, concerns log message handling, where unsanitised user content could inject special characters into logs, though 2.528 and 2.516.3 add indicators for line breaks to mitigate this.

According to Jenkins, organisations should patch promptly or apply mitigations, as exploiting these flaws could disrupt builds and expose sensitive configurations.