CVE-2025-22235

CNA: VMware
Severity: High
Creation date: 24th of April 2025
CWE-20: Improper Input Validation
Affects: Spring^® Boot versions: all open source versions below 3.4.5, excluding 2.7.25+, 2.7.18.tuxcare.6, 3.1.16+, 3.2.14+, 3.3.11+ and 3.4.5+
CVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Note: in 2.7.18.tuxcare.6 version we apply our patch for CVE-2025-22235 to the latest available open source community version as a baseline.

This CVE has been resolved by the TuxCare team and
a patch has been delivered to ELS for Spring^® users.

Discover ELS for Spring^®

Overview
Detailed Exploration of CVE-2025-22235
Vulnerability Info
Mitigation
References

Follow Us On Social

Overview

Spring^® Boot is a framework built on top of the Spring^® Framework that simplifies the development of standalone, production-ready Spring^® applications. It eliminates much of the boilerplate configuration required by traditional Spring^® apps by offering auto-configuration, opinionated defaults, and embedded servers.

Improper input validation takes place when the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.

Your application may be affected by this if all the following conditions are met:

You use Spring^® Security
EndpointRequest.to() has been used in a Spring^® Security chain configuration
The endpoint which EndpointRequest references is disabled or not exposed via web
Your application handles requests to /null and this path needs protection

You are not affected if any of the following is true:

You don’t use Spring^® Security
You don’t use EndpointRequest.to()
The endpoint which EndpointRequest.to() refers to is enabled and is exposed
Your application does not handle requests to /null or this path does not need protection

This issue affects multiple versions of

Spring-boot-actuator-autconfigure package

Vulnerability Dossier
CVE ID	CVE-2025-22235
Severity	HIGH: 7.3
CWE-ID and name	CWE-20: Improper Input Validation
Affected project	Spring^® Boot
Affected packages	spring-boot-actuator-autconfigure
Affected versions	<2.7.0;2.7.24.2> <3.1.0;3.1.15.2> <3.2.0;3.2.13.2> <3.3.0;3.3.10> <3.4.0;3.4.4>
NVD publish date	28th of April 2025
TuxCare fixed version	2.7.18.tuxcare.6

Detailed Exploration of CVE-2025-22235

Affected product: Spring^® Boot
Affected packages: spring-boot-actuator-autconfigure

Affected versions:
- 2.7.0 – 2.7.24.2
- 3.1.0 – 3.1.15.2
- 3.2.0 – 3.2.13.2
- 3.3.0 – 3.3.10
- 3.4.0 – 3.4.4
- Older, unsupported versions are also affected

GitHub repository: https://github.com/spring-projects/spring-boot
Published packages: https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-actuator-autoconfigure

Fixed In: ELS for Spring^® Boot v2.7.18.TuxCare.6

Vulnerability Info

In Spring^® Boot, the EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.

Mitigation

Spring^® Boot 2.7.x is no longer supported by open source community as its End of Life date is 2023-06-30. It simply means that version from that date does not receive any updates to address this issue.

‍Users of the affected components should apply one of the following mitigations:

Leverage the TuxCare support partner for Endless Lifecycle Support that extends regular community EoL security support and simply just apply our patches.
Upgrade to the 3.3.11+ open source community version and accept the risk of not getting any further security updates from the community starting from 30th of June’25.
Alternatively take the effort to upgrade to the latest greatest supported Spring^® Framework open source versions that are not affected e.g. 3.4.5+ and get community support till end of 2025
Do not process requests to `/null`. If handling `/null` is necessary, ensure robust security measures are in place.
Verify that endpoints referenced by `EndpointRequest.to()` are correctly exposed, enabled, and accessible through the web.

Do you need a fix for this vulnerability for any other Spring^® Boot version, please contact us, we are here to help you!