CVE-2025-67635: 
Java vulnerability analysis and mitigation

CVE-2025-67635 is a denial-of-service vulnerability in Jenkins' HTTP-based CLI component, tracked as SECURITY-3630. Jenkins 2.540 and earlier (weekly) and LTS 2.528.2 and earlier do not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated remote attackers to exhaust request-handling threads. The vulnerability was disclosed on December 10, 2025, and carries a CVSS v3.1 base score of 7.5 (High) (Jenkins Advisory, GitHub Advisory).

The root cause is classified as CWE-404 (Improper Resource Shutdown or Release): when an HTTP-based CLI connection stream becomes corrupted, Jenkins fails to properly close the connection, leaving request-handling threads in an indefinite waiting state. An unauthenticated attacker can exploit this by sending crafted HTTP-based CLI connection requests with corrupted streams, causing thread exhaustion without any privileges or user interaction required. The fix in Jenkins 2.541 and LTS 2.528.3 ensures that corrupted connection streams are properly detected and closed (Jenkins Advisory, GitHub Advisory). The vulnerability was discovered and reported by Camilo Vera Vidales (Jenkins Advisory).

Successful exploitation results in a denial-of-service condition affecting the Jenkins controller's availability. By causing request-handling threads to wait indefinitely, an attacker can exhaust the thread pool, rendering the Jenkins HTTP-based CLI — and potentially the broader Jenkins service — unresponsive. This can halt CI/CD pipeline operations, disrupt software delivery workflows, and impact development teams relying on Jenkins for build automation. There is no impact on confidentiality or integrity (Jenkins Advisory, GitHub Advisory).

1. Reconnaissance: Identify internet-facing Jenkins instances running weekly version 2.540 or earlier, or LTS 2.528.2 or earlier, using tools like Shodan or Censys by searching for Jenkins banners or version headers.
2. Identify HTTP-based CLI endpoint: Locate the Jenkins HTTP-based CLI endpoint (typically accessible at /cli or via the Jenkins web interface CLI path) on the target instance.
3. Send corrupted stream requests: Craft HTTP-based CLI connection requests that intentionally corrupt the connection stream (e.g., by sending malformed or truncated data mid-connection), causing Jenkins to fail to close the connection properly.
4. Repeat to exhaust threads: Send multiple such requests in rapid succession to exhaust the Jenkins request-handling thread pool, causing the server to become unresponsive and resulting in a denial-of-service condition (Jenkins Advisory).

• Network: Unusually high volume of HTTP connections to the Jenkins CLI endpoint (/cli) from one or more source IPs; connections that remain open/half-open for extended periods without completing.
• Logs: Jenkins access logs showing repeated requests to the CLI endpoint with incomplete or malformed payloads; thread dump logs revealing large numbers of request-handling threads in a waiting/blocked state.
• Process: Jenkins JVM exhibiting high thread count with threads stuck in I/O wait states related to CLI connection handling; degraded or unresponsive Jenkins web UI coinciding with CLI endpoint traffic spikes.

Jenkins has released patched versions addressing this vulnerability: Jenkins weekly 2.541 and Jenkins LTS 2.528.3. Administrators should upgrade to these versions or later as the primary remediation (Jenkins Advisory). As a temporary workaround if immediate patching is not feasible, restrict network access to the Jenkins HTTP-based CLI interface to trusted IP ranges only, or disable the HTTP-based CLI feature if it is not required. Oracle also addressed this CVE in its April 2026 Critical Patch Update for affected Oracle products (Oracle CPU).

The vulnerability received coverage from multiple security news outlets including CyberSecurityNews, GBHackers, SecurityOnline, and eSecurity Planet, highlighting the risk of unauthenticated DoS against CI/CD infrastructure (SecurityOnline). A Medium blog post titled "CVE-2025-67635: When Jenkins HTTP CLI Becomes a DoS Weapon" provided community-level technical commentary. The Hacker News weekly recap also mentioned the vulnerability in the context of the broader December 2025 Jenkins security advisory. Community sentiment on Reddit and social media noted the low exploitation barrier (no authentication required) as a concern for organizations with publicly exposed Jenkins instances.