A critical vulnerability in Jenkins allows unauthenticated attackers to cause a denial of service by exploiting improper handling of corrupted HTTP-based CLI connections.

The vulnerability exists in the Jenkins CLI component, where corrupted connection streams are not properly terminated. This flaw allows an unauthenticated attacker to exhaust system resources and crash the application service.

The exploitation of this vulnerability results in a denial of service, which can cause significant disruption to CI/CD pipelines and software delivery processes. With a CVSS score of 7.5, the vulnerability is considered High, reflecting the ease of exploitation by unauthenticated remote attackers. Organizations relying on Jenkins for automated build and deployment tasks may face severe operational downtime if the service becomes unavailable.

Immediate Action: Update the Jenkins core to version 2.541 or later, or upgrade to the LTS release 2.528.3 or later to resolve the underlying connection handling issue.

Proactive Monitoring: Monitor server resource utilization and application logs for unusual spikes in CLI connection attempts or unexpected service restarts.

Compensating Controls: Deploy a Web Application Firewall or network access control list to restrict access to the Jenkins CLI port, limiting exposure to trusted network segments until patching is complete.

Public Exploit Available: Unknown

Given the high impact on service availability and the ease of exploitation from an unauthenticated position, administrators should prioritize applying the provided security updates. Testing and deploying the fixed versions 2.541 or 2.528.3 is the only effective way to eliminate the risk of denial of service attacks against your Jenkins infrastructure.