All vulnerabilities

Servers and applications

CVE-2025-59476

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.

Severity
Medium 5.3
Published
17 Sept 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.516.3, 2.528
Sources
NVD

Affected software

SoftwareAffected versions
JenkinsServers and applications · cpe:a:jenkins:jenkins
  • Every version before 2.516.3
  • Every version before 2.528

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-59476
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-59476