Cyber Resilience

CVE-2025-59476

Medium

Published: 17 September 2025

Published
17 September 2025
Modified
04 November 2025
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0010 28.0th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-59476 is a medium-severity Improper Output Neutralization for Logs (CWE-117) vulnerability in Jenkins Jenkins. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by…

more

forged log messages that may mislead administrators reviewing log output.

CWE(s)
CWE-117

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

jenkins
jenkins
≤ 2.516.3 · ≤ 2.528

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-1 Policy and Procedures
addresses: CWE-117

Policy and procedures require sanitization and neutralization when generating audit logs to avoid injection issues.

SI-15 Information Output Filtering
addresses: CWE-117

Requiring output to conform to expected content prevents unneutralized data from reaching logs.

References