CVE-2025-1948 Affecting jenkins-remoting package, versions <2.502-r0


Severity

Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.05% (17th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-JENKINSREMOTING-13319067
  • published6 Oct 2025
  • disclosed8 May 2025

Introduced: 8 May 2025

CVE-2025-1948  (opens in a new tab)

How to fix?

Upgrade Minimos:latest jenkins-remoting to version 2.502-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream jenkins-remoting package and not the jenkins-remoting package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

CVSS Base Scores

version 3.1