Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

CVE-2025-22235 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli...

Security Bulletin: IBM Operational Decision Manager for Oct 2025 - Multiple CVEs addressed

Summary IBM Operational Decision Manager is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-22233...

Improper Authorization Third-Party Dependency in Bitbucket Data Center and Server - CVE-2025-22235

This High severity vulnerability known as CVE-2025-22235 was introduced in 8.19.0, 8.19.1, 8.19.2, 8.19.3, 8.19.4, 8.19.5, 8.19.6, 8.19.7, 8.19.8, 8.19.9, 8.19.10, 8.19.11, 8.19.12, 8.19.13, 8.19.14, 8.19.15, 8.19.16, 8.19.17, 8.19.18, 8.19.19, 8.19.20, 8.19.21, 8.19.23, 8.19.24 of Bitbucket Data...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in Spring [CVE-2025-22235]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in Spring , caused by Spring Boot EndpointRequest.to creating the wrong matcher if the actuator endpoint is not exposed CVE-2025-22235 . Spring is used as part of our Java Microservices. This vulnerabilitiy...

CVE-2025-22235 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, keycloak-config-cli...

com.vilt-group.minium:minium-app (0.9.6), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +36 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.1.7.release)

org.springframework.boot:spring-boot MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.vilt-group.minium:minium-app 0.9.6 - de.codecentric:jbehave-admin-server...

com.github.cafdataprocessing:boilerplate-api-web (>=2.0.0-5, <=2.3.0-92), com.github.cafdataprocessing:corepolicy-web (>=1.0.0-4, <=1.2.0-165) +36 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.1.3.release)

org.springframework.boot:spring-boot MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.github.cafdataprocessing:boilerplate-api-web =2.0.0-5, =1.0.0-4, =1.1.0.cr3...

co.fingerprintsoft:notification-spring-boot-autoconfigure (1.0.6), co.fingerprintsoft:notification-spring-boot-starter (1.0.6) +70 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.3.4.release)

org.springframework.boot:spring-boot MAVEN version 1.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - co.fingerprintsoft:notification-spring-boot-autoconfigure 1.0.6 -...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.10, <=0.1.12), ai.houyi:dorado (>=0.0.6, <=0.0.8) +109 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.5.15.release)

org.springframework.boot:spring-boot MAVEN version 1.5.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter =0.1.10, =0.0.6, =0.0.11,...

org.springframework.boot:spring-boot-actuator (1.1.10.release), org.springframework.boot:spring-boot-autoconfigure (1.1.10.release) +30 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.1.10.release)

org.springframework.boot:spring-boot MAVEN version 1.1.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - org.springframework.boot:spring-boot-actuator 1.1.10.release -...

au.com.dius.pact.provider:spring (>=4.1.0, <=4.1.6), au.com.dius:pact-jvm-provider-spring (>=4.0.0-beta.1, <=4.0.10) +347 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.5.16.release)

org.springframework.boot:spring-boot MAVEN version 1.5.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.dius.pact.provider:spring =4.1.0, =4.0.0-beta.1, =3.6.0-rc.1, =3.6.15 -...

org.grails:grails-gsp-spring-boot (1.0.0), org.springframework.boot:spring-boot-actuator (1.1.11.release) +29 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.1.11.release)

org.springframework.boot:spring-boot MAVEN version 1.1.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - org.grails:grails-gsp-spring-boot 1.0.0 -...

cc.catalysts.boot:cat-boot-javamelody (0.0.4), cn.bestwu:data-rest (1.0.0.m1) +191 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.3.1.release)

org.springframework.boot:spring-boot MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cc.catalysts.boot:cat-boot-javamelody 0.0.4 - cn.bestwu:data-rest 1.0.0.m1 -...

ai.optfor:spring-openai-api (>=0.1.3, <=0.3.25), ai.stapi:arango-axon (>=0.0.1, <=0.0.2) +5670 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (>=3.1.0, <=3.1.12)

org.springframework.boot:spring-boot MAVEN version =3.1.0, =0.1.3, =0.0.1, =0.0.1, =0.0.10, =0.0.10, =0.0.10, =0.0.6, =0.0.6, =0.0.28, =0.0.6, =0.0.7, =0.0.8, =0.0.11, =0.0.6, =1.0.0, =1.4.0 and more Source cves: CVE-2025-22235 Source advisory: OSV:GHSA-RC42-6C7J-7H5R...

com.github.advantageous:qbit-spring (>=0.9.1-rc11, <=0.9.2-rc14), com.github.jmgilmour:parker-spring-boot (0.1.0) +165 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.2.6.release)

org.springframework.boot:spring-boot MAVEN version 1.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.github.advantageous:qbit-spring =0.9.1-rc11, =2.0.1, =2.2.29, =1.0.4, =1.0....

cn.jiangzeyin.fast-boot:common-boot (>=1.1.12, <=1.2.39), cn.jiangzeyin.fast-boot:common-redis (>=1.0.3, <=1.2.39) +236 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.4.7.release)

org.springframework.boot:spring-boot MAVEN version 1.4.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.jiangzeyin.fast-boot:common-boot =1.1.12, =1.0.3, =1.2.28, =1.1.2, =1.1.2,...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.28.0) +7670 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (>=3.3.0, <=3.3.10)

org.springframework.boot:spring-boot MAVEN version =3.3.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2025-22235 Source advisory: OSV:GHSA-RC42-6C7J-7H5R...

co.paralleluniverse:comsat-spring-boot (0.3.0), com.bertramlabs.plugins:asset-pipeline-spring-boot (>=2.0.19, <=2.13.1) +49 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.1.9.release)

org.springframework.boot:spring-boot MAVEN version 1.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - co.paralleluniverse:comsat-spring-boot 0.3.0 -...

co.fingerprintsoft:notification-spring-boot-autoconfigure (1.0.10), co.fingerprintsoft:notification-spring-boot-starter (1.0.10) +146 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.3.8.release)

org.springframework.boot:spring-boot MAVEN version 1.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - co.fingerprintsoft:notification-spring-boot-autoconfigure 1.0.10 -...