Null Endpoint Exposure Vulnerability in Spring Security Framework
CVE-2025-22235

7.3HIGH

Key Information:

Vendor

Spring

Status
Spring Boot
Vendor
CVE Published:
28 April 2025

What is CVE-2025-22235?

The vulnerability occurs in the Spring Security framework when the EndpointRequest.to() method creates a matcher for a null endpoint. This scenario arises if the corresponding actuator endpoint is disabled or not exposed. Applications utilizing Spring Security and handling requests directed to /null without appropriate endpoint exposure may be at risk. To ensure security, developers should verify that their configurations align with best practices and ensure that endpoints are securely managed and monitored.

Affected Version(s)

Spring Boot 2.7.x < 2.7.25

Spring Boot 3.1.x < 3.1.16

Spring Boot 3.2.x < 3.2.14

References

https://spring.io/security/cve-2025-22235

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-22235 : Null Endpoint Exposure Vulnerability in Spring Security Framework