Vulnerability · Published Apr 28, 2025 · Assigned by vmware
CVE-2025-22235Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed
High 7.3
In plain English
A high-severity improper input validation in Spring Boot from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: * You use Spring Security * EndpointRequest.to() has been used in a Spring Security chain configuration * The endpoint which EndpointRequest references is disabled or not exposed via web * Your application handles requests to /null and this path needs protection You are not affected if any of the following is true: * You don't use Spring Security * You don't use EndpointRequest.to() * The endpoint which EndpointRequest.to() refers to is enabled and is exposed * Your application does not handle requests to /null or this path does not need protection
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.boot:spring-boot | no fix listed | GHSA-rc42-6c7j-7h5r |
| Maven | org.springframework.boot:spring-boot | no fix listed | GHSA-rc42-6c7j-7h5r |
| Maven | org.springframework.boot:spring-boot | no fix listed | GHSA-rc42-6c7j-7h5r |
| Maven | org.springframework.boot:spring-boot | 3.3.11 | GHSA-rc42-6c7j-7h5r |
| Maven | org.springframework.boot:spring-boot | 3.4.5 | GHSA-rc42-6c7j-7h5r |
| Ubuntu:25.10 | libspring-java | no fix listed | UBUNTU-CVE-2025-22235 |
| Ubuntu:26.04:LTS | libspring-java | no fix listed | UBUNTU-CVE-2025-22235 |
| Ubuntu:26.10 | libspring-java | no fix listed | UBUNTU-CVE-2025-22235 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Boot | 2.7.x – before 2.7.253.1.x – before 3.1.163.2.x – before 3.2.143.3.x – before 3.3.113.4.x – before 3.4.5 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L