Jenkins CVE-2025-67635

Requires that the Jenkins controller expose the HTTP-based CLI endpoint reachable by the attacker (the CLI over HTTP transport is available in affected default installations). The specific trigger is a CLI connection whose stream becomes corrupted, which Jenkins then fails to close, leaking the connection/resources. No authentication is required (PR:N) and no user interaction (UI:N), so any party able to reach the controller's HTTP port can attempt it. The principal limiting factor is network exposure: controllers that are firewalled, placed behind authenticated reverse proxies, or that have the CLI disabled are not reachable for this attack. Impact is limited to availability - no data disclosure or modification occurs.

Signals are largely consistent and point to a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw with impact confined to availability - there is no confidentiality or integrity loss, so this is a pure denial-of-service issue, not a code-execution or data-breach vector. The EPSS score of 0.56% (45th percentile) is modest and reflects no observed exploitation activity, which is coherent with the absence of a CISA KEV listing and the lack of any referenced public proof-of-concept. There is no conflict between the CVSS network/unauthenticated characterization and the description, which explicitly states unauthenticated attackers can trigger the condition via HTTP-based CLI connections. Net assessment: this is a real, patch-worthy issue for internet-exposed or multi-tenant Jenkins controllers because it needs no credentials and is easy to trigger, but it is lower priority than a comparable RCE - exploitation only degrades/denies service rather than compromising it. No active-exploitation or POC evidence is present in the supplied data, so urgency should be driven by exposure (is the controller reachable by untrusted networks?) rather than by in-the-wild signals.

An unauthenticated attacker with network reach to a Jenkins controller opens HTTP-based CLI connections and deliberately corrupts the connection stream; because Jenkins fails to properly close these corrupted connections, resources (connections/threads) are not released and accumulate until the service degrades or stops responding. Repeating this remotely and without credentials exhausts server resources, denying CI/CD service to legitimate users. No public exploit code is identified in the provided data.