{"id":"CVE-2025-67635","published":"2025-12-10T16:50:35Z","modified":"2025-12-16T13:36:56Z","title":"Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the…","vendor":"Jenkins","product":"Jenkins","tier":"tail","description":{"text":"Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00563,"percentile":0.46706,"provenance":"source"},"cwes":[{"id":"CWE-404","name":"Improper Resource Shutdown or Release"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3630","tags":["vendor-advisory"]}],"priority":{"score":14.6,"factors":[{"name":"EPSS percentile","points":9.34},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"jenkins","affectedVersions":[{"vendor":"Jenkins Project","product":"Jenkins","versions":["all versions"]}],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","vulnerableRanges":[">=2.529, <2.541","<2.528.3"],"patched":["2.541","2.528.3"],"from":["GHSA-9p56-p6mw-w8qc"],"provenance":"source"},{"ecosystem":"Maven","package":"org.jenkins-ci.main:cli","vulnerableRanges":[">=2.529, <2.541","<2.528.3"],"patched":["2.541","2.528.3"],"from":["GHSA-9p56-p6mw-w8qc"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-202453","exploited":false,"provenance":"source"}}