Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-59476

Good to know:

icon

Date: September 17, 2025

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.

Severity Score

Related Resources (4)

https://www.jenkins.io/security/advisory/2025-09-17/#SECURITY-3424
https://github.com/jenkinsci/jenkins
https://nvd.nist.gov/vuln/detail/CVE-2025-59476
https://www.mend.io/vulnerability-database/CVE-2025-59476

Severity Score

Weakness Type (CWE)

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-74

Improper Output Neutralization for Logs

CWE-117

Top Fix

icon

Upgrade Version

Upgrade to version org.jenkins-ci.main:jenkins-core:2.528;org.jenkins-ci.main:jenkins-core:2.516.3;org.jenkins-ci.main:jenkins-core:2.516.3;org.jenkins-ci.main:jenkins-core:2.528

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us