Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

High-Severity Jenkins Vulnerability Allows Unauthenticated DoS via HTTP CLI

Jenkins has released patches to address a significant denial-of-service (DoS) vulnerability affecting numerous organizations utilizing its automation server for continuous integration and deployment pipelines. The vulnerability is present in Jenkins…

HBy Harper FairbanksDec 11, 20251 min read

Jenkins has released patches to address a significant denial-of-service (DoS) vulnerability affecting numerous organizations utilizing its automation server for continuous integration and deployment pipelines. The vulnerability is present in Jenkins versions 2.540 and earlier (LTS 2.528.2 and earlier) and allows unauthenticated attackers to initiate DoS attacks through the HTTP-based command-line interface.

The issue arises from improper connection handling when HTTP CLI streams are corrupted, enabling malicious actors to deplete server resources without authentication. This flaw is due to Jenkins's connection management logic failing to properly terminate corrupted connections.

Attribute Value

CVE ID CVE-2025-67635

Vendor / Project Jenkins

Vulnerability Type Denial of Service (DoS) via HTTP-based CLI

This flaw is due to Jenkins's connection management logic failing to properly terminate corrupted connections.
Harper Fairbanks · Thehackingpost

CVSS Base Score High

CVSS Vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector Network (HTTP-based CLI)

Description Improper closing of corrupted HTTP-based CLI connections allows unauthenticated DoS by exhausting threads.

Advertisement

This vulnerability permits attackers to send specially crafted connection requests that cause request-handling threads to hang indefinitely, effectively freezing resources and hindering legitimate traffic processing. The vulnerability can be exploited remotely without authentication over the network, posing an immediate risk to Jenkins installations exposed to untrusted networks or the public internet.

Organizations are advised to upgrade to Jenkins 2.541 or LTS 2.528.3, which include patches for properly closing HTTP-based CLI connections when stream corruption occurs. These updates restore normal resource cleanup and prevent thread exhaustion attacks.

It is recommended that security teams prioritize patching all Jenkins deployments, especially those facing the internet. Monitoring systems for unusual connection patterns or thread count anomalies that might indicate exploitation attempts is also advised.

Based on reporting by Cyber Security News.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026