Multiple vulnerabilities in Jenkins

[Daniel Beck <dbeck () cloudbees com>]

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.

The following releases contain fixes for security vulnerabilities:

* Jenkins 2.528
* Jenkins LTS 2.516.3


Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2025-09-17/

We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories

If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities

---

SECURITY-3618 / CVE-2025-5115
Jenkins bundles Winstone-Jetty, a wrapper around Jetty, to act as HTTP and
servlet server when started using `java -jar jenkins.war`. This is how
Jenkins is run when using any of the installers or packages, but not when
run using servlet containers such as Tomcat.

Jenkins 2.523 and earlier, LTS 2.516.2 and earlier bundles versions of
Jetty affected by the security vulnerability CVE-2025-5115
("MadeYouReset"). This vulnerability allows unauthenticated attackers to
cause a denial of service.

NOTE: This only affects instances that enable HTTP/2, typically using the
`--http2Port` argument to `java -jar jenkins.war` or corresponding options
in service configuration files. It is disabled by default in all native
installers and the Docker images provided by the Jenkins project.


SECURITY-3594 / CVE-2025-59474
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a
permission check in the sidepanel of a page intentionally accessible to
users lacking Overall/Read permission.

This allows attackers without Overall/Read permission to list agent names
through its sidepanel executors widget.


SECURITY-3625 / CVE-2025-59475
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a
permission check for the authenticated user profile dropdown menu. This
allows attackers without Overall/Read permission to obtain limited
information about the Jenkins configuration by listing available options in
this menu (e.g., whether Credentials Plugin is installed).


SECURITY-3424 / CVE-2025-59476
In Jenkins 2.527 and earlier, LTS 2.516.2 and earlier, the log formatter
that prepares log messages for console output (including `jenkins.log`
and equivalent) does not restrict or transform the characters that can be
inserted from user-specified content in log messages.

This allows attackers able to control log message contents to insert line
break characters, followed by forged log messages that may mislead
administrators reviewing log output.