https://seclists.org/oss-sec/2025/q4/259: Multiple vulnerabilities in Jenkins and Jenkins plugins
Published Dec 10, 2025
·Updated
Affected Software
5 affected components
Jenkins Jenkins<2.540
Jenkins Jenkins LTS<2.528
jenkins/blazemeter-plugin
jenkins/coverage-plugin
jenkins/git-client-plugin
Frequently Asked Questions
1
What is the severity of the vulnerabilities in Jenkins and Jenkins plugins?
The vulnerabilities in Jenkins and its plugins vary in severity, some being critical and others moderate, depending on their impact.
2
How do I fix CVE issues in Jenkins and Jenkins plugins?
To fix the vulnerabilities in Jenkins and Jenkins plugins, upgrade to Jenkins version 2.541, Jenkins LTS version 2.528.3, or update the specific affected plugins.
3
What versions of Jenkins are affected by these vulnerabilities?
The vulnerabilities affect multiple versions of Jenkins prior to 2.541 and Jenkins LTS prior to 2.528.3.
4
Are there specific Jenkins plugins that contain vulnerabilities?
Yes, specific Jenkins plugins such as BlazeMeter Plugin 4.27 and Coverage Plugin 2.3056.v1dfe88 are known to contain vulnerabilities.
5
How can I ensure my Jenkins installation is secure?
To ensure your Jenkins installation is secure, regularly update Jenkins and its plugins to their latest versions to patch vulnerabilities.