CVE-2025-22235
HighAdvisory
Published 28 Apr 2025In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.3
- base score, highest
- EPSS
- 0.004
- 35th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 305
- of 17,781 indexed, latest versions
- Container images
- 261
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed
Carried by container images the latest versions of 305 of 17,781 indexed charts deploy, on 261 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| spring-bootmaven | 1.4.0.RELEASE, 1.4.4.RELEASE, 1.5.2.RELEASE, 1.5.3.RELEASE+85 more | 3.3.11, 3.4.5 | 261 |
- OSV records
- GHSA-rc42-6c7j-7h5r
Charts affected
305 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| webhookie-allwebhookie | 0.1.2 | 1 of 3See more | 28,605 |
| hazelcastwenerme | 5.10.2 | 1 of 2See more | 2,634 |
| workshop-pipelinesworkshop-pipelines | 0.1.6 | 1 of 2See more | 11,577 |
| zahori-processzahoriVerified publisher | 1.0.1 | 1 of 1See more | 3,480 |
| zahori-serverzahoriVerified publisher | 1.0.1 | 1 of 2See more | 5,846 |
Container images carrying it
261 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.