Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.

Affected Packages

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 2.388 (fixed in 2.394)

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 0 (fixed in 2.375.4)

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 2.376 (fixed in 2.387.1)

Related CVEs

CVE-2023-27901

Key Information

GHSA ID

GHSA-h76p-mc68-jv3p

Published

March 10, 2023 9:30 PM

Last Modified

March 17, 2023 2:44 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.main:jenkins-core

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.