CVE-2014-3661: Jenkins Denial of Service vulnerability in org.jenkins-ci.main:jenkins-core
Summary
CVE-2014-3661: Jenkins Denial of Service vulnerability. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 1.565.3
>= 1.566, < 1.583
Fixed in 1.565.3 or 1.583, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. The org.jenkins-ci.main:jenkins-core package is a fundamental component of Jenkins, providing core functionality for the server. This package is vulnerable to a Denial of Service (DoS) attack, which can be exploited remotely. The vulnerability exists in versions before 1.583 for Jenkins and before 1.565.3 for LTS (Long-Term Support) versions of Jenkins.
Vulnerability Detail
The vulnerability allows remote attackers to cause a denial of service by consuming excessive threads during a CLI (Command Line Interface) handshake. This can lead to resource exhaustion and impact the availability of the Jenkins server. The vulnerability has a moderate severity rating and was first published on May 17, 2022. It was reviewed by GitHub on February 8, 2023.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.565.31.565.3 -
>= 1.566, < 1.5831.583
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The org.jenkins-ci.main:jenkins-core package is vulnerable to a Denial of Service attack. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of the package. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability can result in a denial of service, causing the Jenkins server to become unresponsive and impacting its availability for users.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
There are no known exploits mentioned for this vulnerability.
No, the provided vulnerability details do not include a CVSS score.
You can find more information about this vulnerability in the GitHub Advisory Database. The provided source link in the vulnerability details section will direct you to the relevant advisory.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
