CVE-2025-0509: jre Signing Checks Bypass Vulnerability
Summary
CVE-2025-0509: Signing Checks Bypass. Affects jre across 2 version ranges.
< 1.8.0
>= 1.9.0, < 8.0.441
Fixed in 1.8.0 or 8.0.441, depending on the release line you run. How to fix ↓
Also tracked for
- java-min · Bitnami
- java · Bitnami
- github.com/sparkle-project/Sparkle · SwiftURL
The same CVE-2025-0509 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jre package, provided by Bitnami, is a Java Runtime Environment that allows users to run Java applications. It is widely used in various applications and services due to its ability to execute Java bytecode. However, vulnerabilities in its update mechanism can lead to significant security risks, especially when updates are not properly verified.
Vulnerability Detail
A security issue was identified in Sparkle before version 2.6.4, where an attacker could replace an existing signed update with a malicious payload. This bypasses Sparkle's (Ed)DSA signing checks, allowing unauthorized code execution. The vulnerability arises from improper validation of signed updates, which can lead to severe consequences, including data breaches and system compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.8.01.8.0 -
>= 1.9.0, < 8.0.4418.0.441
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can disable automatic updates for the jre package until you can apply the patch. This can be done by modifying your update settings in your package manager.
Conclusion
The CVE-2025-0509 vulnerability in the jre package poses a significant risk by allowing attackers to bypass critical signing checks. It is essential to update to the latest patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for jre →
FAQ
CVE-2025-0509 is a vulnerability in the jre package that allows attackers to bypass signing checks for updates.
If exploited, this vulnerability can allow malicious code to be executed on your system, potentially leading to data loss or unauthorized access.
The vulnerability affects jre versions before 1.8.0 and 8.0.441.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring installation.
If you cannot update immediately, consider disabling automatic updates as a temporary workaround until you can apply the necessary patches.
Related vulnerabilities
Recent vulnerabilities recorded for jre.
