CVE-2012-6072: CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1....

Security readout for executives and security teams

Older Jenkins releases could let a remote attacker manipulate HTTP responses by injecting line breaks into headers. That can support response-splitting attacks, potentially affecting users who access a vulnerable Jenkins instance. The bundle does not provide CVSS scoring, affected components, or active exploitation evidence. Exposure is most likely in legacy Jenkins or Jenkins Enterprise deployments still running the affected pre-fixed versions, especially reachable web interfaces. The source bundle lists placeholder CPE data, so asset teams should validate by installed product and version rather than CPE matching alone. Treat this as a legacy Jenkins hygiene issue with moderate business urgency. It matters most where old Jenkins interfaces are still reachable by untrusted users. Lack of active exploitation evidence lowers immediacy, but unsupported CI infrastructure can create broader operational risk. Mitigation focus: Upgrade Jenkins to 1.491 or later, or Jenkins LTS to 1.480.1 or later.; Upgrade affected Jenkins Enterprise branches to the fixed versions named in vendor guidance.; Prioritize replacing unsupported legacy Jenkins releases with a currently supported release..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.