Sign in
Deutsch English Español Polski
Medium

Excessive memory allocation in graph URLs leads to denial of service in Jenkins

  • Disclosed: 24.05.2022
  • Updated: 11.10.2026 11:22

Jenkins renders several different graphs for features like agent and label usage statistics, memory usage, or various plugin-provided statistics.

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit the graph size provided as query parameters.

This allows attackers to request or to have legitimate Jenkins users request crafted URLs that rapidly use all available memory in Jenkins, potentially leading to out of memory errors.

Jenkins 2.275, LTS 2.263.2 limits the maximum size of graphs to an area of 10 million pixels. If a larger size is requested, the default size for the graph will be rendered instead.

This threshold can be configured by setting the Java system property hudson.util.Graph.maxArea to a different number on startup.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.jenkins-ci.main:jenkins-core < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275

References

CVSS score 6.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-770
Platform
Java / Kotlin (Maven)
Package
org.jenkins-ci.main:jenkins-core
Disclosed
24.05.2022
Updated
11.10.2026 11:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-cxqw-vjcr-gp5g - CC BY 4.0

Vulnerability history: org.jenkins-ci.main:jenkins-core

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (259) in the archive
Total entries
259
First → latest
01.2022 06.2026
Without a fix
1
Exploited in attacks
4

Severity breakdown

  • Critical 19
  • High 62
  • Medium 158
  • Low 20

Disclosures per year

Severity:
  1. Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
    High · 8.8 CVE-2026-53435 < 2.555.3, >= 2.556, < 2.568 2.555.3, 2.568
  2. Jenkins: Stored XSS vulnerability in node offline cause description
    High · 8.0 CVE-2026-53441 >= 2.483, < 2.568 2.568
  3. Jenkins has a link following vulnerability allows arbitrary file creation
    High · 8.8 CVE-2026-33001 < 2.555 2.555
  4. Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
    High · 7.5 CVE-2026-33002 >= 2.442, < 2.555 2.555
  5. Jenkins has a stored XSS vulnerability in node offline cause description
    High · 8.0 CVE-2026-27099 >= 2.542, < 2.551, >= 2.483, < 2.541.2 2.551, 2.541.2
  6. Jenkins has a Denial of service vulnerability in HTTP-based CLI
    High · 7.5 CVE-2025-67635 >= 2.529, < 2.541, < 2.528.3 2.541, 2.528.3
  7. Jenkins Remoting library arbitrary file read vulnerability
    High · 9.0 CVE-2024-43044 < 2.452.4, >= 2.460, < 2.462.1, >= 2.470, < 2.471 2.452.4, 2.462.1, 2.471
  8. Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
    Critical · 9.8 Exploited in attacks CVE-2024-23897 >= 1.606, < 2.426.3, >= 2.427, < 2.440.1, >= 2.441, < 2.442 2.426.3, 2.440.1, 2.442
  9. Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
    High · 8.8 CVE-2024-23898 >= 2.217, < 2.426.3, >= 2.427, < 2.442, = 2.441 2.426.3, 2.442
  10. Jenkins temporary plugin file created with insecure permissions
    High · 7.0 CVE-2023-43496 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  11. Jenkins Cross-site Scripting vulnerability
    High · 8.0 CVE-2023-43495 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  12. Jenkins Stored Cross-site Scripting vulnerability
    High · 8.0 CVE-2023-39151 >= 2.402, < 2.414.1, < 2.401.3, >= 2.415, < 2.416 2.414.1, 2.401.3, 2.416
  13. Jenkins CSRF protection bypass vulnerability
    High · 8.0 CVE-2023-35141 < 2.400 2.400
  14. Cross-site Scripting vulnerability in Jenkins
    High · 8.8 CVE-2023-27898 >= 2.376, < 2.394, < 2.375.4 2.394, 2.375.4
  15. Incorrect Authorization in Jenkins Core
    High · 7.0 CVE-2023-27899 >= 2.376, < 2.387.1, < 2.375.4, >= 2.388, < 2.394 2.387.1, 2.375.4, 2.394
  16. Denial of service in Jenkins Core
    High · 7.5 CVE-2023-27901 >= 2.388, < 2.394, < 2.375.4, >= 2.376, < 2.387.1 2.394, 2.375.4, 2.387.1
  17. Jenkins vulnerable to stored cross site scripting in the I:helpIcon component
    High · 8.0 CVE-2022-41224 >= 2.367, < 2.370 2.370
  18. Cross-site Scripting vulnerability in Jenkins
    High · 8.0 CVE-2022-34170 >= 2.350, < 2.356, >= 2.320, < 2.332.4, >= 2.346, < 2.346.1 2.356, 2.332.4, 2.346.1
  19. Unauthorized view fragment access in Jenkins
    High · 7.5 CVE-2022-34175 >= 2.335, < 2.356 2.356
  20. Cross-site Scripting vulnerability in Jenkins
    High · 8.0 CVE-2022-34173 >= 2.340, < 2.356 2.356
  21. Cross-site Scripting vulnerability in Jenkins
    High · 8.0 CVE-2022-34172 >= 2.340, < 2.356, >= 2.332, < 2.332.4 2.356, 2.332.4
  22. Cross-site Scripting vulnerability in Jenkins
    High · 8.0 CVE-2022-34171 >= 2.350, < 2.356, >= 2.346, < 2.346.1, < 2.332.4 2.356, 2.346.1, 2.332.4
  23. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21686 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  24. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21685 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  25. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21689 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  26. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21690 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  27. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21692 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  28. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21693 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  29. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21694 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  30. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21688 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  31. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21691 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  32. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21687 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  33. Agent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin
    High · 8.8 CVE-2021-21696 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  34. Agent-to-controller access control allows reading/writing most content of build directories in Jenkins
    Critical · 9.1 CVE-2021-21697 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  35. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21695 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  36. Session fixation vulnerability in Jenkins
    High · 7.5 CVE-2021-21671 >= 2.292, < 2.300, < 2.289.2 2.300, 2.289.2
  37. Excessive memory allocation in graph URLs leads to denial of service in Jenkins this entry
    Medium · 6.5 CVE-2021-21607 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  38. Path traversal vulnerability in Jenkins agent names
    High · 8.0 CVE-2021-21605 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  39. Improper handling of REST API XML deserialization errors in Jenkins
    High · 8.0 CVE-2021-21604 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  40. Jenkins Cross-site Scripting vulnerability in project naming strategy
    High · 8.0 CVE-2020-2230 < 2.235.4, >= 2.236, < 2.252 2.235.4, 2.252
Show more (20) Showing 40 of 82

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.