TI-2025-16145 Aliases CVE-2025-22235 GHSA-rc42-6c7j-7h5r

Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed

LOW 38CWE-20Published 2025-04-28 · Updated 2025-05-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Partial Red Hat: 8 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.

Summary

EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: * You use Spring Security * EndpointRequest.to() has been used in a Spring Security chain configuration * The endpoint which EndpointRequest references is disabled or not exposed via web * Your application handles requests to /null and this path needs protection You are not affected if any of the following is true: * You don't use Spring Security * You don't use EndpointRequest.to() * The endpoint which EndpointRequest.to() refers to is enabled and is exposed * Your application does not handle requests to /null or this path does not need protection

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00441 38th percentileScored 2026-11-07

Fix Partial Spring Boot (Spring): 2.7.25, 3.1.16, 3.2.14 +2org.springframework.boot:spring-boot (Maven): 3.3.11, 3.4.5Red Hat: 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VMware	Spring Boot	2.7.x to before 2.7.25; 3.1.x to before 3.1.16; 3.2.x to before 3.2.14; 3.3.x to before 3.3.11; 3.4.x to before 3.4.5	2.7.25, 3.1.16, 3.2.14, 3.3.11, 3.4.5	Patch available	CNA
—	org.springframework.boot:spring-boot (Maven)	up to 2.7.24.2	—	No fix listed	GHSA-rc42-6c7j-7h5r
—	org.springframework.boot:spring-boot (Maven)	3.1.0 – 3.1.15.2	—	No fix listed	GHSA-rc42-6c7j-7h5r
—	org.springframework.boot:spring-boot (Maven)	3.2.0 – 3.2.13.2	—	No fix listed	GHSA-rc42-6c7j-7h5r
—	org.springframework.boot:spring-boot (Maven)	3.3.0 to before 3.3.11	3.3.11	Patch available	GHSA-rc42-6c7j-7h5r
—	org.springframework.boot:spring-boot (Maven)	3.4.0 to before 3.4.5	3.4.5	Patch available	GHSA-rc42-6c7j-7h5r

Spring Boot VendorVMware Affected 2.7.x to before 2.7.25; 3.1.x to before 3.1.16; 3.2.x to before 3.2.14; 3.3.x to before 3.3.11; 3.4.x to before 3.4.5 Fixed in 2.7.25, 3.1.16, 3.2.14, 3.3.11, 3.4.5 Patch available CNA
org.springframework.boot:spring-boot (Maven) Vendor— Affected up to 2.7.24.2 Fixed in — No fix listed GHSA-rc42-6c7j-7h5r
org.springframework.boot:spring-boot (Maven) Vendor— Affected 3.1.0 – 3.1.15.2 Fixed in — No fix listed GHSA-rc42-6c7j-7h5r
org.springframework.boot:spring-boot (Maven) Vendor— Affected 3.2.0 – 3.2.13.2 Fixed in — No fix listed GHSA-rc42-6c7j-7h5r
org.springframework.boot:spring-boot (Maven) Vendor— Affected 3.3.0 to before 3.3.11 Fixed in 3.3.11 Patch available GHSA-rc42-6c7j-7h5r
org.springframework.boot:spring-boot (Maven) Vendor— Affected 3.4.0 to before 3.4.5 Fixed in 3.4.5 Patch available GHSA-rc42-6c7j-7h5r

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:vmware:spring_boot::::::::	—	—	VMware

cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:* Versions — — ·VMware

Remediation

Fix · CNA Spring Boot (Spring) Fixed in 2.7.25, 3.1.16, 3.2.14, 3.3.11, 3.4.5
Fix · GHSA-rc42-6c7j-7h5r org.springframework.boot:spring-boot (Maven) Fixed in 3.3.11 Advisory →
Fix · GHSA-rc42-6c7j-7h5r org.springframework.boot:spring-boot (Maven) Fixed in 3.4.5 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
A-MQ Clients 2	Affected	No fix yet
Red Hat AMQ Clients	Affected	No fix yet
Red Hat Data Grid 8	Affected	No fix planned: Will not fix
Red Hat Fuse 7	Affected	No fix planned: Will not fix
Red Hat Integration Camel K 1	Affected	No fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7	Affected	No fix planned: Will not fix
Red Hat build of OptaPlanner 8	Affected	No fix planned: Will not fix
streams for Apache Kafka	Affected	No fix planned: Will not fix

Not affected: 8 products

Red Hat AMQ Broker 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat JBoss Enterprise Application Platform 8
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat Process Automation 7
Red Hat Single Sign-On 7
Red Hat build of Apache Camel for Spring Boot 4

Timeline

2026-10-02 Threatist record created from CVE-2025-22235
2026-10-03 Alias added: GHSA-rc42-6c7j-7h5r

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-22235

Other 3

TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8

See all 1181 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences