VulnerableCode Package Details - pkg:maven/org.springframework.boot/spring-boot@2.7.24.2

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/org.springframework.boot/spring-boot@2.7.24.2

Essentials
History (2)

purl	pkg:maven/org.springframework.boot/spring-boot@2.7.24.2
Tags	Ghost

Next non-vulnerable version	3.0.13
Latest non-vulnerable version	3.4.5
Risk	4.0

Vulnerabilities affecting this package (1)

Vulnerability	Summary	Fixed by
VCID-k3fg-3bs3-87b9 Aliases: CVE-2025-22235 GHSA-rc42-6c7j-7h5r	Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: * You use Spring Security * EndpointRequest.to() has been used in a Spring Security chain configuration * The endpoint which EndpointRequest references is disabled or not exposed via web * Your application handles requests to /null and this path needs protection You are not affected if any of the following is true: * You don't use Spring Security * You don't use EndpointRequest.to() * The endpoint which EndpointRequest.to() refers to is enabled and is exposed * Your application does not handle requests to /null or this path does not need protection	3.0.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 3.3.11 Affected by 0 other vulnerabilities. 3.4.5 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-k3fg-3bs3-87b9
Aliases:
CVE-2025-22235
GHSA-rc42-6c7j-7h5r

Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: * You use Spring Security * EndpointRequest.to() has been used in a Spring Security chain configuration * The endpoint which EndpointRequest references is disabled or not exposed via web * Your application handles requests to /null and this path needs protection You are not affected if any of the following is true: * You don't use Spring Security * You don't use EndpointRequest.to() * The endpoint which EndpointRequest.to() refers to is enabled and is exposed * Your application does not handle requests to /null or this path does not need protection

3.0.0
Affected by 1 other vulnerability.

3.3.11
Affected by 0 other vulnerabilities.

3.4.5
Affected by 0 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-07T04:57:41.345378+00:00	GHSA Importer	Affected by	VCID-k3fg-3bs3-87b9	https://github.com/advisories/GHSA-rc42-6c7j-7h5r	38.1.0
2026-04-02T12:41:20.456766+00:00	GitLab Importer	Affected by	VCID-k3fg-3bs3-87b9	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework.boot/spring-boot/CVE-2025-22235.yml	38.0.0