PT-2025-13818 · Jooby+1 · Jooby+1

Published 2025-03-31 · Updated 2025-04-01 · CVE-2025-31129

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jooby versions prior to 2.17.0 Jooby versions prior to 3.7.0

Description The issue concerns the deserialization of untrusted data by the SessionStoreImpl#get module in the pac4j library of the Jooby web framework for Java and Kotlin.

Recommendations For versions prior to 2.17.0, update to version 2.17.0 or later. For versions prior to 3.7.0, update to version 3.7.0 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-31129

GHSA-7C5V-895V-W4Q5

Affected Products

Jooby

Pac4J

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31129.json · Exploit
• https://osv.dev/vulnerability/GHSA-7c5v-895v-w4q5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-31129 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-31129 · Security Note
• https://github.com/jooby-project/jooby/security/advisories/GHSA-7c5v-895v-w4q5 · Note
• https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692 · Note
• https://github.com/jooby-project/jooby/blob/v2.x/modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java#L39-L45 · Note
• https://github.com/jooby-project/jooby/blob/v3.6.1/modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java#L77-L84 · Note
• https://github.com/jooby-project/jooby · Note
• https://t.me/cvetracker/20386 · Telegram Post
• https://t.me/cvedetector/21653 · Telegram Post
• https://twitter.com/CVEnew/status/1906790160399765836 · Twitter Post