Null Endpoint Exposure Vulnerability in Spring Security Framework

CVE-2025-22235

What is CVE-2025-22235?

The vulnerability occurs in the Spring Security framework when the EndpointRequest.to() method creates a matcher for a null endpoint. This scenario arises if the corresponding actuator endpoint is disabled or not exposed. Applications utilizing Spring Security and handling requests directed to /null without appropriate endpoint exposure may be at risk. To ensure security, developers should verify that their configurations align with best practices and ensure that endpoints are securely managed and monitored.

References