CVE-2016-9299: Improper Neutralization of Special Elements used in an LDAP Query in Jenkins
Summary
CVE-2016-9299: Improper Neutralization of Special Elements used in an LDAP Query in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.19.3
>= 2.20, < 2.32
Fixed in 2.19.3 or 2.32, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support continuous integration and delivery processes. The 'jenkins-core' package is a fundamental component of Jenkins, responsible for its core functionality.
Vulnerability Detail
The remoting module in Jenkins before version 2.32 and LTS before version 2.19.3 is vulnerable to an attack that allows remote code execution. This vulnerability arises from improper neutralization of special elements used in an LDAP query. An attacker can exploit this flaw by sending a crafted serialized Java object, triggering an LDAP query to a third-party server. Successful exploitation of this vulnerability can lead to arbitrary code execution on the affected Jenkins instance.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.19.32.19.3 -
>= 2.20, < 2.322.32
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the remoting module in Jenkins. This can be achieved by modifying the Jenkins configuration file and setting the 'disableRemoting' property to 'true'. However, this workaround may impact the functionality of certain Jenkins features that rely on the remoting module.
Conclusion
The vulnerability in the 'jenkins-core' package allows remote code execution through a crafted serialized Java object, triggering an LDAP query. Upgrading to version 2.32 or later is the recommended solution to fix this vulnerability. Alternatively, users can temporarily disable the remoting module, but this may impact certain Jenkins features. It is crucial to take immediate action to mitigate the risk of arbitrary code execution. For additional support, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
This vulnerability allows remote attackers to execute arbitrary code on the affected Jenkins instance, potentially leading to a complete compromise of the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your 'pom.xml' file, and Vulert will analyze it for any open-source vulnerabilities, including this specific issue.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is crucial to apply the recommended fix to prevent any potential exploitation.
While upgrading Jenkins to the latest version is the recommended approach, you can temporarily mitigate the risk by disabling the remoting module in the Jenkins configuration. However, this workaround may impact certain Jenkins features that rely on the remoting module.
For further support and assistance in remediating this vulnerability, you can reach out to info@devnack.com. Our team of experts will be happy to assist you.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
