Listen to this Post
The vulnerability resides in the Jenkins HTTP-based Command Line Interface (CLI), a feature allowing remote administration. This CLI operates over a dedicated HTTP endpoint, maintaining persistent connections for command execution. When an attacker sends a specifically corrupted or malformed HTTP request sequence to this endpoint, it disrupts the normal stream parsing logic. The flaw is triggered when the connection’s input or output stream becomes unreadable or throws an unexpected I/O exception. Instead of properly terminating and cleaning up the associated socket and thread resources, the Jenkins master enters an error state where it fails to close the connection. This results in a resource leak where the connection handle and processing thread are kept in a limbo state, still counted against server limits. With repeated exploitation, an attacker can exhaust the available worker threads or socket descriptors for the CLI port. Since the CLI service shares the underlying Jetty/web server infrastructure, this exhaustion can lead to a complete denial of service, preventing legitimate users and administrators from accessing the Jenkins web UI or API. The attack is unauthenticated, requiring no prior access to the system, and can be performed remotely against the open CLI port.
Platform: Jenkins
Version: 2.540 earlier
Vulnerability: HTTP CLI DoS
Severity: High
date: Dec 10 2025
Prediction: Patch expected soon
What Undercode Say:
Analytics:
curl -I http://jenkins-host:PORT/cli/ nmap -p 80,443,8080 --script http- jenkins-host grep -r "CLICommand" /var/lib/jenkins/jenkins_home/war/WEB-INF/classes/ journalctl -u jenkins | grep -i "connection|stream|cli" | tail -50
// Simulating stream corruption
Socket s = new Socket("jenkins-host", CLI_PORT);
OutputStream os = s.getOutputStream();
os.write("GET /cli/ HTTP/1.1\r\n".getBytes());
os.write("Malformed: Header\r\n\r\n".getBytes());
// Do not close socket
How Exploit:
Send corrupted HTTP request streams repeatedly to the Jenkins CLI endpoint (e.g., `http://target:8080/cli/`). Use a script to open many concurrent connections and prematurely corrupt the TCP stream or HTTP headers, causing the server to enter the faulty state without closing sockets. This exhausts thread pool and file descriptors.
Protection from this CVE:
Apply vendor update. Disable HTTP-based CLI if unused. Restrict network access to Jenkins CLI port. Implement rate limiting. Use reverse proxy WAF.
Impact:
Full denial of service. Unauthenticated attack leads to Jenkins master unavailability, disrupting all builds and management functions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
