CVE-2023-27900: Jenkins

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.

Affected products

• Jenkins Jenkins: before 2.375.4 (fixed in 2.375.4); before 2.394 (fixed in 2.394)

Published 2023-03-10. Last modified 2026-06-17.