CVE-2025-59476: Jenkins Log Injection Vulnerability

CVE-2025-59476 Overview

CVE-2025-59476 is a log injection vulnerability affecting Jenkins 2.527 and earlier, and Jenkins LTS 2.516.2 and earlier. The vulnerability stems from Jenkins failing to restrict or transform special characters in user-supplied content written to log messages. Attackers who can control log message contents can inject line break characters followed by forged log entries. These forged entries may mislead administrators reviewing log output during security investigations or routine monitoring.

The issue is tracked as CWE-117: Improper Output Neutralization for Logs and was disclosed in the Jenkins Security Advisory #SECURITY-3424.

Critical Impact
Attackers can forge log entries to obscure malicious activity or mislead administrators investigating security incidents in Jenkins environments.

Affected Products

Jenkins 2.527 and earlier (weekly release line)
Jenkins LTS 2.516.2 and earlier
All platforms running affected Jenkins versions

Discovery Timeline

2025-09-17 - Jenkins publishes Security Advisory SECURITY-3424
2025-09-17 - CVE-2025-59476 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59476

Vulnerability Analysis

The vulnerability exists in how Jenkins processes user-controllable content before writing it to log messages. Jenkins does not neutralize or transform characters such as carriage returns (\r) and line feeds (\n) that indicate the end of a log line. When an attacker supplies input containing these control characters, the logging subsystem writes them verbatim.

The result is that a single logical log entry can be split into multiple visual entries. An attacker can append fabricated log lines that appear to originate from Jenkins itself. Administrators reviewing logs to investigate incidents may treat these forged entries as authoritative.

This vulnerability is network-exploitable, requires no privileges, and requires no user interaction, per the CVSS vector. The impact is limited to integrity of log data. Confidentiality and availability are not affected.

Root Cause

The root cause is missing output neutralization when user-controlled strings are inserted into Jenkins log messages. Jenkins concatenates untrusted values into logger calls without stripping or escaping newline characters. This is the classic pattern described by CWE-117.

Attack Vector

An attacker submits input to any Jenkins interface that ultimately reaches a log message. Common vectors include job parameters, HTTP request fields, plugin inputs, and API calls that Jenkins echoes into log output. By embedding \r\n sequences followed by a plausible timestamp and message, the attacker injects forged entries. The forged entries appear indistinguishable from legitimate Jenkins log output during casual review.

See the Jenkins Security Advisory and the OpenWall OSS-Security posting for technical details.

Detection Methods for CVE-2025-59476

Indicators of Compromise

Log entries containing unusual whitespace, missing thread identifiers, or inconsistent timestamp formatting relative to surrounding lines
Duplicate or out-of-sequence log lines within the Jenkins controller log
Log lines that reference user actions with no corresponding audit or build history record
Presence of raw CR/LF byte sequences (0x0D 0x0A) inside logged field values captured at the source

Detection Strategies

Compare Jenkins controller logs against build execution records and audit trails to identify entries without a matching event
Parse logs with a strict schema aware of Jenkins log formatting and flag lines that do not conform
Alert on user-supplied fields (job names, parameters, HTTP headers) that contain encoded or raw newline characters
Forward Jenkins logs to a centralized platform where structural anomalies can be queried at scale

Monitoring Recommendations

Ship Jenkins logs to a SIEM or data lake with normalization so forged entries can be correlated against authoritative sources
Monitor Jenkins system, access, and build logs for newline characters within request parameters and header values
Track administrator log review activity so incident responders know which entries were relied upon during investigations

How to Mitigate CVE-2025-59476

Immediate Actions Required

Upgrade Jenkins weekly to version 2.528 or later
Upgrade Jenkins LTS to version 2.516.3 or later
Review Jenkins controller logs generated before patching for signs of injected entries
Restrict who can submit values that reach Jenkins log messages, including job parameters and webhook payloads

Patch Information

Jenkins addressed CVE-2025-59476 by neutralizing line break characters in user-supplied content before writing it to log messages. Apply the fixed versions documented in the Jenkins Security Advisory #SECURITY-3424. No configuration changes are required after upgrading.

Workarounds

No official workaround is published by the Jenkins project; upgrading is the supported remediation
Reduce exposure by placing Jenkins behind authentication and limiting anonymous access to endpoints that echo input into logs
Apply reverse proxy filters that strip CR/LF characters from HTTP request fields destined for Jenkins
Enforce input validation on job parameters and webhook payloads that pass through to logging code paths

bash

# Verify installed Jenkins version and upgrade on Debian/Ubuntu
dpkg -l | grep jenkins
sudo systemctl stop jenkins
sudo apt-get update && sudo apt-get install --only-upgrade jenkins
sudo systemctl start jenkins

# Confirm fixed version (LTS 2.516.3+ or weekly 2.528+)
curl -s http://localhost:8080/api/json | grep -o '"version":"[^"]*"'