CVE-2025-31129

Description

Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. This vulnerability is fixed in 2.17.0 (2.x) and 3.7.0 (3.x).

Reserved 2025-03-26 | Published 2025-03-31 | Updated 2025-04-01 | Assigner GitHub_M

Problem types

CWE-502: Deserialization of Untrusted Data

Product status

>= 3.0.0.M1, < 3.7.0
affected

< 2.17.0
affected

References

github.com/.../jooby/security/advisories/GHSA-7c5v-895v-w4q5

github.com/...ommit/3e13562cf36d7407813eae464e0f4b598de15692

github.com/.../io/jooby/internal/pac4j/SessionStoreImpl.java

github.com/.../io/jooby/internal/pac4j/SessionStoreImpl.java

cve.org (CVE-2025-31129)

nvd.nist.gov (CVE-2025-31129)

Download JSON