PT-2025-28022 · Unknown+1 · Spring-Boot-Actuator+1

Published 2025-07-04 · Updated 2025-07-05 · CVE-2025-53602

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Zipkin versions prior to 3.5.2

Description: The issue is related to the exposure of heap dump information through the "/heapdump" endpoint, which is associated with the use of Spring Boot Actuator. This endpoint is similar to a previously identified issue.

Recommendations: For versions prior to 3.5.2, update to version 3.5.2 or later to resolve the issue. As a temporary workaround, consider disabling the "/heapdump" endpoint until a patch is available.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2025-53602

GHSA-794X-8X6X-QPFC

Affected Products

Spring-Boot-Actuator

Zipkin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-53602 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53602 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-794x-8x6x-qpfc · Vendor Advisory
• https://github.com/openzipkin/zipkin · Note
• https://github.com/openzipkin/zipkin/pull/3804 · Note
• https://github.com/openzipkin/zipkin/commit/3c7605dfdfab2dd341cf0ea121a56cefcd580d9e · Note
• https://t.me/cvenotify/127733 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1941379845734220196 · Twitter Post
• https://twitter.com/CVEnew/status/1941244517631381540 · Twitter Post
• https://zipkin.io · Note