CVE-2025-22235
Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.
Your application may be affected by this if all the following conditions are met:
- You use Spring Security
- EndpointRequest.to() has been used in a Spring Security chain configuration
- The endpoint which EndpointRequest references is disabled or not exposed via web
- Your application handles requests to /null and this path needs protection
You are not affected if any of the following is true:
- You don't use Spring Security
- You don't use EndpointRequest.to()
- The endpoint which EndpointRequest.to() refers to is enabled and is exposed
- Your application does not handle requests to /null or this path does not need protection
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.
Your application may be affected by this if all the following conditions are met:
- You use Spring Security
- EndpointRequest.to() has been used in a Spring Security chain configuration
- The endpoint which EndpointRequest references is disabled or not exposed via web
- Your application handles requests to /null and this path needs protection
You are not affected if any of the following is true:
- You don't use Spring Security
- You don't use EndpointRequest.to()
- The endpoint which EndpointRequest.to() refers to is enabled and is exposed
- Your application does not handle requests to /null or this path does not need protection
- Record
CVE-2025-22235- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2025-12575
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.
Your application may be affected by this if all the following conditions are met:
- You use Spring Security
- EndpointRequest.to() has been used in a Spring Security chain configuration
- The endpoint which EndpointRequest references is disabled or not exposed via web
- Your application handles requests to /null and this path needs protection
You are not affected if any of the following is true:
- You don't use Spring Security
- You don't use EndpointRequest.to()
- The endpoint which EndpointRequest.to() refers to is enabled and is exposed
- Your application does not handle requests to /null or this path does not need protection
- Record
EUVD-2025-12575- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rc42-6c7j-7h5r
Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.
Your application may be affected by this if all the following conditions are met:
- You use Spring Security
- EndpointRequest.to() has been used in a Spring Security chain configuration
- The endpoint which EndpointRequest references is disabled or not exposed via web
- Your application handles requests to /null and this path needs protection
You are not affected if any of the following is true:
- You don't use Spring Security
- You don't use EndpointRequest.to()
- The endpoint which EndpointRequest.to() refers to is enabled and is exposed
- Your application does not handle requests to /null or this path does not need protection
- Record
GHSA-rc42-6c7j-7h5r- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-20, CWE-862
- Updated
- 2026-11-02
NVD
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.
Your application may be affected by this if all the following conditions are met:
- You use Spring Security
- EndpointRequest.to() has been used in a Spring Security chain configuration
- The endpoint which EndpointRequest references is disabled or not exposed via web
- Your application handles requests to /null and this path needs protection
You are not affected if any of the following is true:
- You don't use Spring Security
- You don't use EndpointRequest.to()
- The endpoint which EndpointRequest.to() refers to is enabled and is exposed
- Your application does not handle requests to /null or this path does not need protection
- Record
CVE-2025-22235- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-rc42-6c7j-7h5r
Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.
Your application may be affected by this if all the following conditions are met:
- You use Spring Security
- EndpointRequest.to() has been used in a Spring Security chain configuration
- The endpoint which EndpointRequest references is disabled or not exposed via web
- Your application handles requests to /null and this path needs protection
You are not affected if any of the following is true:
- You don't use Spring Security
- You don't use EndpointRequest.to()
- The endpoint which EndpointRequest.to() refers to is enabled and is exposed
- Your application does not handle requests to /null or this path does not need protection
- Record
GHSA-rc42-6c7j-7h5r- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-20, CWE-862
- Updated
- 2026-11-02
OSVRHLW-2026-196e0bd4df0804a6
Lightwell Security Advisory: spring-boot 2.7.18.rhlw-00004
Red Hat Lightwell has released org.springframework.boot:spring-boot 2.7.18.rhlw-00004 with backported fixes for CVE-2025-22235 and CVE-2026-40973.
CVE-2026-40973: A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
This patched artifact is a drop-in replacement for org.springframework.boot:spring-boot 2.7.18 from Maven Central.
- Record
RHLW-2026-196e0bd4df0804a6- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 19 moreShow less
OSVROOT-APP-MAVEN-CVE-2025-22235
CVE-2025-22235 in io.root.org.springframework.boot:spring-boot - Patched by Root
Root has patched CVE-2025-22235 in the io.root.org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2025-22235- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-22235
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: * You use Spring Security * EndpointRequest.to() has been used in a Spring Security chain configuration * The endpoint which EndpointRequest references is disabled or not exposed via web * Your application handles requests to /null and this path needs protection You are not affected if any of the following is true: * You don't use Spring Security * You don't use EndpointRequest.to() * The endpoint which EndpointRequest.to() refers to is enabled and is exposed * Your application does not handle requests to /null or this path does not need protection
- Record
UBUNTU-CVE-2025-22235- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVCLSA-2025-1748390600 No score
TuxCare security update for org.springframework.boot (1 CVE)
TuxCare rebuilt 2 org.springframework.boot packages to address 1 CVE. Fixed in 2.7.18.tuxcare.6.
- Record
CLSA-2025-1748390600- Updated
- 2026-11-02
OSVCLSA-2025-1752019358 No score
TuxCare security update for org.springframework.boot (5 CVEs)
TuxCare rebuilt 6 org.springframework.boot packages to address 5 CVEs. Fixed in 2.4.6.tuxcare.2.
- Record
CLSA-2025-1752019358- Updated
- 2026-11-02
OSVCLSA-2025-1754006610 No score
TuxCare security update for org.springframework.boot (1 CVE)
TuxCare rebuilt 2 org.springframework.boot packages to address 1 CVE. Fixed in 2.6.15.tuxcare.1.
- Record
CLSA-2025-1754006610- Updated
- 2026-11-02
OSVCLSA-2026-1770336547 No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 3 org.springframework.boot packages to address 2 CVEs. Fixed in 3.1.8-tuxcare.1.
- Record
CLSA-2026-1770336547- Updated
- 2026-11-02
OSVCLSA-2026-1778805965 No score
TuxCare security update for org.springframework.boot (3 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 3 CVEs. Fixed in 2.7.16-tuxcare.1.
- Record
CLSA-2026-1778805965- Updated
- 2026-11-02
OSVCLSA-2026-1779929353 No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 4 CVEs. Fixed in 2.4.5-tuxcare.1.
- Record
CLSA-2026-1779929353- Updated
- 2026-11-02
OSVCLSA-2026-1783558970 No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 2 CVEs. Fixed in 3.2.12-tuxcare.1.
- Record
CLSA-2026-1783558970- Updated
- 2026-11-02
OSVCLSA-2026-1783645398 No score
TuxCare security update for org.springframework.boot (3 CVEs)
TuxCare rebuilt 5 org.springframework.boot packages to address 3 CVEs. Fixed in 3.0.13-tuxcare.1.
- Record
CLSA-2026-1783645398- Updated
- 2026-11-02
OSVCLSA-2026-1783904634 No score
TuxCare security update for org.springframework.boot (6 CVEs)
TuxCare rebuilt 6 org.springframework.boot packages to address 6 CVEs. Fixed in 2.5.15-tuxcare.1.
- Record
CLSA-2026-1783904634- Updated
- 2026-11-02
OSVCLSA-2026-1783991067 No score
TuxCare security update for org.springframework.boot (9 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 9 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.1.
- Record
CLSA-2026-1783991067- Updated
- 2026-11-02
OSVCLSA-2026-1784164094 No score
TuxCare security update for org.springframework.boot (7 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 7 CVEs. Fixed in 2.3.6.RELEASE-tuxcare.5.
- Record
CLSA-2026-1784164094- Updated
- 2026-11-02
OSVCLSA-2026-1784769561 No score
TuxCare security update for org.springframework.amqp (2 CVEs)
TuxCare rebuilt 7 org.springframework.amqp packages to address 2 CVEs. Fixed in 3.1.8-tuxcare.1.
- Record
CLSA-2026-1784769561- Updated
- 2026-11-02
OSVCLSA-2026-1786536841 No score
TuxCare security update for org.springframework.data (3 CVEs)
TuxCare rebuilt 5 org.springframework.data packages to address 3 CVEs. Fixed in 3.2.12-tuxcare.1.
- Record
CLSA-2026-1786536841- Updated
- 2026-11-02
OSVCLSA-2026-1786543557 No score
TuxCare security update for org.springframework.data (3 CVEs)
TuxCare rebuilt 4 org.springframework.data packages to address 3 CVEs. Fixed in 3.2.12-tuxcare.1.
- Record
CLSA-2026-1786543557- Updated
- 2026-11-02
OSVCLSA-2026-1786547094 No score
TuxCare security update for org.springframework.data:spring-data-ldap (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-ldap to address 3 CVEs. Fixed in 3.2.12-tuxcare.1.
- Record
CLSA-2026-1786547094- Updated
- 2026-11-02
OSVCLSA-2026-1789371263 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 7 org.springframework.amqp packages to address 3 CVEs. Fixed in 3.2.12-tuxcare.1.
- Record
CLSA-2026-1789371263- Updated
- 2026-11-02
OSVCLSA-2026-1793805334 No score
TuxCare security update for org.springframework.boot (5 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 5 CVEs. Fixed in 2.7.9-tuxcare.2.
- Record
CLSA-2026-1793805334- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-bootMaven |
through 2.7.24.2 | None known |
org.springframework.boot:spring-bootMaven |
3.1.0 to 3.1.15.2 | None known |
org.springframework.boot:spring-bootMaven |
3.2.0 to 3.2.13.2 | None known |
org.springframework.boot:spring-bootMaven |
3.3.0 to 3.3.10 | 3.3.11 |
org.springframework.boot:spring-bootMaven |
3.4.0 to 3.4.4 | 3.4.5 |
org.springframework.boot:spring-bootTuxCare:Maven |
2.7.18 up to 2.7.18.tuxcare.6, plus listed versions 2.7.18.tuxcare2.7.18.tuxcare.12.7.18.tuxcare.22.7.18.tuxcare.32.7.18.tuxcare.42.7.18.tuxcare.5 |
2.7.18.tuxcare.6 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven |
2.7.18 up to 2.7.18.tuxcare.6, plus listed versions 2.7.18.tuxcare2.7.18.tuxcare.12.7.18.tuxcare.22.7.18.tuxcare.32.7.18.tuxcare.42.7.18.tuxcare.5 |
2.7.18.tuxcare.6 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
Show 63 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-starter-webTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-boot-starter-webfluxTuxCare:Maven From an advisory covering 5 CVEs |
2.4.6 up to 2.4.6.tuxcare.2 | 2.4.6.tuxcare.2 |
org.springframework.boot:spring-bootTuxCare:Maven |
2.6.15 up to 2.6.15.tuxcare.1 | 2.6.15.tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven |
2.6.15 up to 2.6.15.tuxcare.1 | 2.6.15.tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs |
3.1.8 up to 3.1.8-tuxcare.1 | 3.1.8-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 2 CVEs |
3.1.8 up to 3.1.8-tuxcare.1 | 3.1.8-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 2 CVEs |
3.1.8 up to 3.1.8-tuxcare.1 | 3.1.8-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 3 CVEs |
2.7.16 up to 2.7.16-tuxcare.1 | 2.7.16-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 3 CVEs |
2.7.16 up to 2.7.16-tuxcare.1 | 2.7.16-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 3 CVEs |
2.7.16 up to 2.7.16-tuxcare.1 | 2.7.16-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 3 CVEs |
2.7.16 up to 2.7.16-tuxcare.1 | 2.7.16-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.1 | 2.4.5-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs |
3.2.12 up to 3.2.12-tuxcare.1 | 3.2.12-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 2 CVEs |
3.2.12 up to 3.2.12-tuxcare.1 | 3.2.12-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 2 CVEs |
3.2.12 up to 3.2.12-tuxcare.1 | 3.2.12-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 2 CVEs |
3.2.12 up to 3.2.12-tuxcare.1 | 3.2.12-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 3 CVEs |
3.0.13 up to 3.0.13-tuxcare.1 | 3.0.13-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 3 CVEs |
3.0.13 up to 3.0.13-tuxcare.1 | 3.0.13-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 3 CVEs |
3.0.13 up to 3.0.13-tuxcare.1 | 3.0.13-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 3 CVEs |
3.0.13 up to 3.0.13-tuxcare.1 | 3.0.13-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 3 CVEs |
3.0.13 up to 3.0.13-tuxcare.1 | 3.0.13-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-bootMaven |
through 2.7.24.2, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.1.0.RELEASE1.1.1.RELEASE Show 45 moreShow less1.1.10.RELEASE1.1.11.RELEASE1.1.12.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.1.6.RELEASE1.1.7.RELEASE1.1.8.RELEASE1.1.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.2.5.RELEASE1.2.6.RELEASE1.2.7.RELEASE1.2.8.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.4.7.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.10.RELEASE1.5.11.RELEASE1.5.12.RELEASE1.5.13.RELEASE1.5.14.RELEASE1.5.15.RELEASE |
None known |
org.springframework.boot:spring-bootMaven |
3.1.0 to 3.1.15.2, plus listed versions 3.1.13.1.103.1.113.1.123.1.2 Show 7 moreShow less3.1.33.1.43.1.53.1.63.1.73.1.83.1.9 |
None known |
org.springframework.boot:spring-bootMaven |
3.2.0 to 3.2.13.2, plus listed versions 3.2.13.2.103.2.113.2.123.2.2 Show 7 moreShow less3.2.33.2.43.2.53.2.63.2.73.2.83.2.9 |
None known |
org.springframework.boot:spring-bootMaven |
3.3.0 up to 3.3.11, plus listed versions 3.3.13.3.103.3.23.3.33.3.4 Show 5 moreShow less3.3.53.3.63.3.73.3.83.3.9 |
3.3.11 |
org.springframework.boot:spring-bootMaven |
3.4.0 up to 3.4.5, plus listed versions 3.4.13.4.23.4.33.4.4 |
3.4.5 |
org.springframework.boot:spring-bootRed Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 2.7.18.rhlw-00004, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.1.0.RELEASE1.1.1.RELEASE Show 45 moreShow less1.1.10.RELEASE1.1.11.RELEASE1.1.12.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.1.6.RELEASE1.1.7.RELEASE1.1.8.RELEASE1.1.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.2.5.RELEASE1.2.6.RELEASE1.2.7.RELEASE1.2.8.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.4.7.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.10.RELEASE1.5.11.RELEASE1.5.12.RELEASE1.5.13.RELEASE1.5.14.RELEASE1.5.15.RELEASE |
2.7.18.rhlw-00004 |
io.root.org.springframework.boot:spring-bootRoot:Maven |
before 3.4.4-root.io.1 | 3.4.4-root.io.13.4.4-root.io.23.4.4-root.io.33.4.4-root.io.43.4.2-root.io.23.2.0-root.io.23.4.4-root.io.53.4.4-root.io.63.3.4-root.io.13.3.4-root.io.23.3.4-root.io.33.4.2-root.io.33.4.4-root.io.73.2.0-root.io.3 |
org.springframework.boot:spring-bootRoot:Maven |
before 3.3.4-aikido.3 | 3.3.4-aikido.33.4.2-aikido.33.4.4-aikido.73.2.0-aikido.3 |
libspring-javaUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.0.6.RELEASE-73.0.6.RELEASE-83.0.6.RELEASE-93.0.6.RELEASE-103.0.6.RELEASE-11 Show 4 moreShow less3.0.6.RELEASE-123.0.6.RELEASE-133.0.6.RELEASE-13ubuntu0.1~esm13.0.6.RELEASE-13ubuntu0.1~esm2 |
None known |
libspring-javaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.2.13-33.2.13-43.2.13-53.2.13-5ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.3.11-14.3.12-14.3.13-24.3.14-14.3.22-1~18.044.3.22-1~18.04.1~esm1 |
None known |
libspring-javaUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.3.22-44.3.22-4ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 4.3.30-14.3.30-1ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 4.3.30-24.3.30-2ubuntu0.24.04.1~esm1 |
None known |
libspring-javaUbuntu:25.10 |
All versions, plus listed versions 4.3.30-2ubuntu14.3.30-3ubuntu1 |
None known |
libspring-javaUbuntu:26.10 |
All versions, plus listed versions 4.3.30-3ubuntu1 |
None known |
libspring-javaUbuntu:26.04:LTS |
All versions, plus listed versions 4.3.30-3ubuntu1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | idealzh/cve-2025-22235-demo | 2025-08-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-22235 is a high vulnerability (CVSS 7.3) in Spring Boot, published April 28, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in org.springframework.boot:spring-boot 3.3.11.
References
Left out here: 272 versions. The JSON record has them.