CVE-2025-59476
Jenkins has a log message injection vulnerability
5.3
MEDIUM
CVSS 3.1
EPSS 0.34%
Description
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.
How to fix CVE-2025-59476
To remediate CVE-2025-59476, upgrade the affected package to a fixed version below.
- —upgrade to 2.516.3 or later
- —upgrade to 2.516.3 or later
Is CVE-2025-59476 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 2.516.3, >= 2.517.0, < 2.528.0
- from 0, < 2.516.3
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |