Read the docs
TI-2012-00722 Aliases CVE-2012-0785GHSA-pchp-c5w8-47gc

Uncontrolled resource consumption in Jenkins

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."

Why it matters now

EPSS 0.03351 88th percentileScored 2026-11-07
Fix Fixed Jenkins (Jenkins project): 1.447Jenkins LTS (Jenkins project): 1.424.2+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkinsbefore 1.4471.447Patch availableCNA
JenkinsJenkins LTSbefore 1.424.21.424.2Patch availableCNA
JenkinsJenkins Enterprise by CloudBees1.424 to before 1.424.2.1; 1.400 to before 1.400.0.111.424.2.1, 1.400.0.11Patch availableCNA
—org.jenkins-ci.main:jenkins-core (Maven)1.425 to before 1.4471.447Patch availableGHSA-pchp-c5w8-47gc
—org.jenkins-ci.main:jenkins-core (Maven)before 1.424.21.424.2Patch availableGHSA-pchp-c5w8-47gc
  • Jenkins VendorJenkins Affected before 1.447 Fixed in 1.447 Patch available CNA
  • Jenkins LTS VendorJenkins Affected before 1.424.2 Fixed in 1.424.2 Patch available CNA
  • Jenkins Enterprise by CloudBees VendorJenkins Affected 1.424 to before 1.424.2.1; 1.400 to before 1.400.0.11 Fixed in 1.424.2.1, 1.400.0.11 Patch available CNA
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 1.425 to before 1.447 Fixed in 1.447 Patch available GHSA-pchp-c5w8-47gc
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 1.424.2 Fixed in 1.424.2 Patch available GHSA-pchp-c5w8-47gc

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:cloudbees:jenkins:*:*:*:*:enterprise:*:*:*1.400.0 to before 1.400.0.11; 1.424.0 to before 1.424.2.1VulnerableCloudBees
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*before 1.424.2VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*before 1.447VulnerableJenkins
  • cpe:2.3:a:cloudbees:jenkins:*:*:*:*:enterprise:*:*:* Versions 1.400.0 to before 1.400.0.11; 1.424.0 to before 1.424.2.1 Vulnerable ·CloudBees
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions before 1.424.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* Versions before 1.447 Vulnerable ·Jenkins

Remediation

  • Fix · CNA Jenkins (Jenkins project) Fixed in 1.447
  • Fix · CNA Jenkins LTS (Jenkins project) Fixed in 1.424.2
  • Fix · CNA Jenkins Enterprise by CloudBees (Jenkins project) Fixed in 1.424.2.1, 1.400.0.11
  • Fix · GHSA-pchp-c5w8-47gc org.jenkins-ci.main:jenkins-core (Maven) Fixed in 1.447 Advisory →
  • Fix · GHSA-pchp-c5w8-47gc org.jenkins-ci.main:jenkins-core (Maven) Fixed in 1.424.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-0785
  2. 2026-10-03 Alias added: GHSA-pchp-c5w8-47gc

References

Advisory 5

Other 2

  • TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
  • TI-2016-07596 The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers… CVSS 3.0CRITICAL 9.8
See all 293 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences