CVE-2025-22235: Spring Boot EndpointRequest.to() Creates Incorrect Matcher for Disabled Actuator Endpoints
Summary
CVE-2025-22235: Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed. Affects org.springframework.boot:spring-boot across 5 version ranges.
< 2.7.24.2
>= 3.1.0, <= 3.1.15.2
>= 3.2.0, <= 3.2.13.2
>= 3.3.0, < 3.3.11
>= 3.4.0, < 3.4.5
Fixed in 2.7.24.2, 3.3.11 or 3.4.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Spring Boot is a popular framework for building Java-based applications, providing a range of features to simplify the development process. It includes built-in support for creating RESTful web services, integrating with various databases, and managing application configurations. The framework also offers actuator endpoints that provide insights into the application's health and metrics. However, a vulnerability has been identified in the EndpointRequest.to() method, which can lead to security issues if certain actuator endpoints are disabled or not exposed.
Vulnerability Detail
The vulnerability arises from the EndpointRequest.to() method creating a matcher for null/** when the referenced actuator endpoint is disabled or not exposed. This can lead to unintended access to the /null path, which may not be adequately protected. The conditions for this vulnerability to affect an application include the use of Spring Security, the utilization of EndpointRequest.to() in the security chain configuration, and the application handling requests to /null. If these conditions are met, an attacker could exploit this flaw to gain unauthorized access to sensitive resources.
How To Fix
Latest published version: 4.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.24.22.7.24.2 -
>= 3.3.0, < 3.3.113.3.11 -
>= 3.4.0, < 3.4.53.4.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can avoid using EndpointRequest.to() for disabled or unexposed actuator endpoints in your Spring Security configuration. Instead, explicitly define the security rules for the paths that need protection, ensuring that /null is not accessible unless intended.
Conclusion
The CVE-2025-22235 vulnerability in Spring Boot poses a significant risk if certain conditions are met. It is crucial for developers using Spring Security and EndpointRequest.to() to update to the latest patched versions to mitigate this risk. Additionally, implementing workarounds can help protect applications until the update is applied.
See every vulnerability recorded for org.springframework.boot:spring-boot →
FAQ
CVE-2025-22235 is a vulnerability in Spring Boot that allows for incorrect matcher creation for disabled actuator endpoints, potentially leading to unauthorized access.
If you are using Spring Security, have configured EndpointRequest.to() for a disabled actuator endpoint, and handle requests to /null, your application may be affected.
Exploitation of this vulnerability could allow attackers to access sensitive resources that should be protected, leading to potential data breaches.
Update your pom.xml file to include the latest patched version of Spring Boot, such as 3.4.5 or later, and then rebuild your application.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the pom.xml file. You can check if your application is affected by this vulnerability using the Vulert playground without signup.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.boot:spring-boot.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
