# org.jenkins-ci.main:cli (Maven) vulnerabilities 2 known vulnerabilities (1 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.589 (Nov 3, 2026): no advisory affects it - Newest unaffected release: 2.589 (Nov 3, 2026), the latest release - Dependents: 6 - Releases: 500+ since 1.396 (Feb 13, 2024) - Registry: https://central.sonatype.com/artifact/org.jenkins-ci.main/cli - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2025-67635: 1.396 to 2.528.2 (2.528.3 is outside it); 2.529 to 2.540 (2.541 is outside it) - CVE-2015-8103: 1.396 to 1.636 (1.642 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (2) ### [CVE-2025-67635](https://cve.now/CVE-2025-67635): Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes… - Severity: High 7.5 - Published: Dec 10, 2025 - Affected: from 2.529, fixed in 2.541; fixed in 2.528.3. - Fixed in 2.528.3 (released Dec 8, 2025, 2 days before disclosure) and 2.541 (released Dec 8, 2025, 2 days before disclosure). - The latest release, 2.589, is not affected. ### [CVE-2015-8103](https://cve.now/CVE-2015-8103): The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted… - Severity: Unrated - Published: Nov 25, 2015 - Affected: fixed in 1.625.2; from 1.626, fixed in 1.638. - Fixed in 1.642 (released Feb 13, 2024, 3002 days after disclosure, the advisory names 1.625.2, which was never published). - The latest release, 2.589, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.jenkins-ci.main:cli Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.