CVE-2025-31129 jooby-pac4j: deserialization of untrusted data

Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImplget module deserializes untrusted data. This vulnerability is fixed in 2.17.0 2.x and 3.7.0 3.x...

CVE-2025-31129

Summary: CVE-2025-31129 affects the Jooby pac4j integration. In io.jooby.internal.pac4j.SessionStoreImpl#get, values are deserialized from untrusted data (notably for payloads starting with “b64~”), which can enable code execution. The issue is fixed in Jooby releases 2.17.0 (2.x stream) and 3.7....

CVE-2025-31129 jooby-pac4j: deserialization of untrusted data

Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImplget module deserializes untrusted data. This vulnerability is fixed in 2.17.0 2.x and 3.7.0 3.x...

PT-2025-13818 · Jooby +1 · Jooby +1

Name of the Vulnerable Software and Affected Versions: Jooby versions prior to 2.17.0 Jooby versions prior to 3.7.0 Description: The issue concerns the deserialization of untrusted data by the SessionStoreImplget module in the pac4j library of the Jooby web framework for Java and Kotlin...

Jooby code issue vulnerabilities

jooby is a modular web framework for Java and Kotlin from jooby open source. A code issue vulnerability exists in jooby version 2.17.0 and versions prior to 3.7.0, which stems from deserializing untrusted data...

CVE-2025-31129: Deserialization of Untrusted Data

Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImplget module deserializes untrusted data. This vulnerability is fixed in 2.17.0 2.x and 3.7.0 3.x...

io.skullabs.kikaha:kikaha-core (>=2.0.0-beta1, <=2.0.0-beta4), io.skullabs.kikaha:kikaha-db (>=2.0.0-beta1, <=2.0.0-beta4) +11 more potentially affected by CVE-2023-4639 via io.undertow:undertow-core (1.3.20.final)

io.undertow:undertow-core MAVEN version 1.3.20.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.skullabs.kikaha:kikaha-core =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1,...

io.mangoo:mangooio-core (>=2.0.0-rc2, <=2.0.0-rc3), io.mangoo:mangooio-integration-test (>=2.0.0-rc2, <=2.0.0-rc3) +24 more potentially affected by CVE-2023-4639 via io.undertow:undertow-core (1.3.9.final)

io.undertow:undertow-core MAVEN version 1.3.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.mangoo:mangooio-core =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =0.12.0, =0.12.0, =0.13.1 -...

io.undertow:undertow-servlet (1.4.9.final), io.undertow:undertow-websockets-jsr (1.4.9.final) +1 more potentially affected by CVE-2023-4639 via io.undertow:undertow-core (1.4.9.final)

io.undertow:undertow-core MAVEN version 1.4.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.4.9.final - io.undertow:undertow-websockets-jsr 1.4.9.final -...

io.undertow:undertow-servlet (1.4.9.final), io.undertow:undertow-websockets-jsr (1.4.9.final) +1 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.4.9.final)

io.undertow:undertow-core MAVEN version 1.4.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.4.9.final - io.undertow:undertow-websockets-jsr 1.4.9.final -...

io.skullabs.kikaha:kikaha-core (>=2.0.0-beta1, <=2.0.0-beta4), io.skullabs.kikaha:kikaha-db (>=2.0.0-beta1, <=2.0.0-beta4) +11 more potentially affected by CVE-2024-7885 via io.undertow:undertow-core (1.3.20.final)

io.undertow:undertow-core MAVEN version 1.3.20.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.skullabs.kikaha:kikaha-core =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1,...

io.undertow:undertow-servlet (1.4.9.final), io.undertow:undertow-websockets-jsr (1.4.9.final) +1 more potentially affected by CVE-2024-3653 via io.undertow:undertow-core (1.4.9.final)

io.undertow:undertow-core MAVEN version 1.4.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.4.9.final - io.undertow:undertow-websockets-jsr 1.4.9.final -...

io.skullabs.kikaha:kikaha-core (>=2.0.0-beta1, <=2.0.0-beta4), io.skullabs.kikaha:kikaha-db (>=2.0.0-beta1, <=2.0.0-beta4) +11 more potentially affected by CVE-2024-3653 via io.undertow:undertow-core (1.3.20.final)

io.undertow:undertow-core MAVEN version 1.3.20.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.skullabs.kikaha:kikaha-core =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1,...

io.skullabs.kikaha:kikaha-core (>=2.0.0-beta1, <=2.0.0-beta4), io.skullabs.kikaha:kikaha-db (>=2.0.0-beta1, <=2.0.0-beta4) +11 more potentially affected by CVE-2024-5971 via io.undertow:undertow-core (1.3.20.final)

io.undertow:undertow-core MAVEN version 1.3.20.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.skullabs.kikaha:kikaha-core =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1,...

io.skullabs.kikaha:kikaha-core (>=2.0.0-beta1, <=2.0.0-beta4), io.skullabs.kikaha:kikaha-db (>=2.0.0-beta1, <=2.0.0-beta4) +11 more potentially affected by CVE-2024-6162 via io.undertow:undertow-core (1.3.20.final)

io.undertow:undertow-core MAVEN version 1.3.20.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.skullabs.kikaha:kikaha-core =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1,...

io.undertow:undertow-servlet (1.4.9.final), io.undertow:undertow-websockets-jsr (1.4.9.final) +1 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.4.9.final)

io.undertow:undertow-core MAVEN version 1.4.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.4.9.final - io.undertow:undertow-websockets-jsr 1.4.9.final -...

io.skullabs.kikaha:kikaha-core (>=2.0.0-beta1, <=2.0.0-beta4), io.skullabs.kikaha:kikaha-db (>=2.0.0-beta1, <=2.0.0-beta4) +11 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.3.20.final)

io.undertow:undertow-core MAVEN version 1.3.20.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.skullabs.kikaha:kikaha-core =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1,...

io.skullabs.kikaha:kikaha-core (>=2.0.0-beta1, <=2.0.0-beta4), io.skullabs.kikaha:kikaha-db (>=2.0.0-beta1, <=2.0.0-beta4) +11 more potentially affected by CVE-2024-1459 via io.undertow:undertow-core (1.3.20.final)

io.undertow:undertow-core MAVEN version 1.3.20.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.skullabs.kikaha:kikaha-core =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1,...

io.undertow:undertow-servlet (1.4.9.final), io.undertow:undertow-websockets-jsr (1.4.9.final) +1 more potentially affected by CVE-2024-1459 via io.undertow:undertow-core (1.4.9.final)

io.undertow:undertow-core MAVEN version 1.4.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.4.9.final - io.undertow:undertow-websockets-jsr 1.4.9.final -...

io.jooby:jooby-jstachio (3.0.0.m7), io.jstach:jstachio-jmustache (0.12.0) +5 more potentially affected by CVE-2023-33962 via io.jstach:jstachio (0.12.0)

io.jstach:jstachio MAVEN version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.jstach:jstachio and may be impacted: - io.jooby:jooby-jstachio 3.0.0.m7 - io.jstach:jstachio-jmustache 0.12.0 - io.jstach:jstachio-spring 0.12.0 -...