Critical Vulnerability in libspring-java: EndpointRequest.to() Null Path Exposure
Summary
UBUNTU-CVE-2025-22235: EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Affects libspring-java versions 3.0.6.RELEASE-10 – 3.0.6.RELEASE-9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a core library in the Spring Framework, widely used for building Java applications. It provides essential features such as dependency injection, aspect-oriented programming, and transaction management. The library is integral for developers seeking to create robust and scalable applications. However, it is susceptible to a specific vulnerability that can compromise application security if not addressed.
Vulnerability Detail
The vulnerability arises from the EndpointRequest.to() method, which creates a matcher for null/** if the actuator endpoint is disabled or not exposed. This can lead to unauthorized access if the application handles requests to /null and requires protection. The conditions for exploitation include using Spring Security, having EndpointRequest.to() in the security chain, and the referenced endpoint being disabled or not exposed. The CVSS score for this vulnerability is 7.3, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using EndpointRequest.to() for endpoints that are disabled or not exposed. Additionally, ensure that your application does not handle requests to /null or that such paths are adequately protected.
Conclusion
The vulnerability in libspring-java related to EndpointRequest.to() poses a significant risk to applications using this library. It is crucial for developers to update to the patched version and implement workarounds to safeguard their applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for libspring-java →
FAQ
The vulnerability allows unauthorized access to endpoints if the application is not properly configured, particularly when using EndpointRequest.to() with disabled or unexposed endpoints.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to sensitive endpoints, potentially compromising application security and data integrity.
Yes, a patched version of the libspring-java package is available. It is recommended to update to this version to mitigate the risk.
If an immediate update is not possible, implement the suggested workarounds to limit exposure and protect sensitive endpoints.
References
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
