Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Dec 10, 2025 | Oct 1, 2014 |
| Jenkins 2014 10 01 | — | Upgrade Jenkins LTS to version 1.565.3Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 1.583 | Nov 13, 2017 | Oct 16, 2014 |
| Redhat Openshift | — | Upgrade jenkinsUpgrade nodejs-slideUpgrade nodejs-pause-streamUpgrade nodejs-lodash.assignUpgrade nodejs-semverUpgrade nodejs-arr-diffUpgrade nodejs-filename-regexUpgrade nodejs-lodash.keysUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-latest-versionUpgrade nodejs-ansi-greenUpgrade nodejs-glob-parentUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-nodemonUpgrade nodejs-ps-treeUpgrade nodejs-is-numberUpgrade nodejs-pinkie-promiseUpgrade nodejs-parse-globUpgrade nodejs-parse-jsonUpgrade nodejs-randomaticUpgrade nodejs-package-jsonUpgrade nodejs-throughUpgrade nodejs-event-streamUpgrade nodejs-capture-stack-traceUpgrade nodejs-duplexerUpgrade nodejs-for-ownUpgrade nodejs-lodash.basecopyUpgrade nodejs-preserveUpgrade jenkins-plugin-openshiftUpgrade nodejs-chokidarUpgrade openshift-origin-cartridge-jenkinsUpgrade nodejs-create-error-classUpgrade nodejs-object-assignUpgrade nodejs-lodash.isarrayUpgrade nodejs-registry-urlUpgrade atomic-openshiftUpgrade nodejs-arr-flattenUpgrade nodejs-undefsafeUpgrade nodejs-stream-combinerUpgrade nodejs-unzip-responseUpgrade nodejs-is-plain-objUpgrade nodejs-is-globUpgrade nodejs-osenvUpgrade nodejs-isobjectUpgrade nodejs-es6-promiseUpgrade nodejs-touchUpgrade nodejs-glob-baseUpgrade nodejs-error-exUpgrade nodejs-end-of-streamUpgrade nodejs-semver-diffUpgrade nodejs-lodash.baseassignUpgrade nodejs-optimistUpgrade nodejs-success-symbolUpgrade nodejs-os-homedirUpgrade nodejs-timed-outUpgrade nodejs-bracesUpgrade nodejs-is-equal-shallowUpgrade nodejs-url-parse-laxUpgrade nodejs-binary-extensionsUpgrade nodejs-write-file-atomicUpgrade nodejs-lodash.isargumentsUpgrade nodejs-for-inUpgrade nodejs-os-tmpdirUpgrade nodejs-xdg-basedirUpgrade nodejs-array-uniqueUpgrade nodejs-align-textUpgrade nodejs-prepend-httpUpgrade nodejs-splitUpgrade nodejs-uuidUpgrade nodejs-kind-ofUpgrade nodejs-is-extglobUpgrade nodejs-async-eachUpgrade nodejs-deep-extendUpgrade nodejs-node-status-codesUpgrade nodejs-rcUpgrade nodejs-string-lengthUpgrade nodejs-lodash.restparamUpgrade nodejs-expand-rangeUpgrade nodejs-lodash.createassignerUpgrade nodejs-mkdirpUpgrade nodejs-anymatchUpgrade nodejs-repeat-elementUpgrade openvswitchUpgrade nodejs-update-notifierUpgrade nodejs-micromatchUpgrade nss_wrapperUpgrade nodejs-is-streamUpgrade nodejs-lodash.defaultsUpgrade nodejs-is-npmUpgrade nodejs-pinkieUpgrade nodejs-is-dotfileUpgrade nodejs-extglobUpgrade heapsterUpgrade nodejs-fromUpgrade nodejs-lowercase-keysUpgrade nodejs-fill-rangeUpgrade nodejs-is-extendableUpgrade nodejs-iniUpgrade nodejs-normalize-pathUpgrade nodejs-strip-json-commentsUpgrade openshift-ansibleUpgrade nodejs-map-streamUpgrade nodejs-lodash.getnativeUpgrade nodejs-read-all-streamUpgrade nodejs-gotUpgrade nodejs-is-primitiveUpgrade nodejs-expand-bracketsUpgrade nodejs-ansi-wrapUpgrade nodejs-configstoreUpgrade nodejs-regex-cacheUpgrade nodejs-graceful-fsUpgrade nodejs-duplexifyUpgrade nodejs-arrifyUpgrade nodejs-is-redirectUpgrade nodejs-object.omitUpgrade nodejs-readdirpUpgrade origin-kibanaUpgrade nodejs-is-binary-pathUpgrade nodejs-lazy-cache | Jun 18, 2018 | Oct 2, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub