# CVE-2025-67635: Jenkins has a Denial of service vulnerability in HTTP-based CLI

Source: https://junglewise.ai/threats/cve-2025-67635-jenkins-has-a-denial-of-service-vulnerability-in-http-based-cli  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-10  
License: CC BY 4.0 with a link back

CVE-2025-67635 · Severity: high · CVSS 7.5 · Published 2025-12-10

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.

Technologies: [Jenkins](https://junglewise.ai/threats/technologies/jenkins), [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2025-67635 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67635 being exploited in the wild.

**How severe is CVE-2025-67635?** High severity, with a CVSS score of 7.5, published 10 December 2025.

**Which products and versions are affected?** org.jenkins-ci.main:cli (Maven) ECOSYSTEM:introduced=2.529,fixed=2.541; org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=2.529,fixed=2.541.

**Is there a fix for CVE-2025-67635?** Yes. org.jenkins-ci.main:cli (Maven): upgrade to 2.541 or later; org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.541 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-67635?** Check whether you run Jenkins, org.jenkins-ci.main:cli (Maven) or org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.main:cli (Maven): upgrade to 2.541 or later

  ```sh
  # set org.jenkins-ci.main:cli to 2.541 in your pom.xml or build.gradle
  ```

- org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.541 or later

  ```sh
  # set org.jenkins-ci.main:jenkins-core to 2.541 in your pom.xml or build.gradle
  ```


## Affected products

- Jenkins
- org.jenkins-ci.main:cli (Maven) ECOSYSTEM:introduced=2.529,fixed=2.541
- org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=2.529,fixed=2.541

## Identifiers

- CVE-2025-67635
- GHSA-9p56-p6mw-w8qc

## Related threats

- [Jenkins path traversal in file browser workspace disclosure](https://junglewise.ai/threats/cve-2026-117626-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-improperly)
- [Jenkins missing HTTP proxy permission check](https://junglewise.ai/threats/cve-2026-117625-a-missing-permission-check-in-jenkins-2-587-and-earlier-lts-2)
- [Jenkins deserialization filter bypass in XStream resolves-to attribute](https://junglewise.ai/threats/cve-2026-117624-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins stored cross-site scripting in breadcrumb menu tooltips](https://junglewise.ai/threats/cve-2026-117623-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins agent XSS via Stapler HttpResponse exceptions](https://junglewise.ai/threats/cve-2026-117622-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows-agents)