~ / search / GHSA-794x-8x6x-qpfc

GHSA-794x-8x6x-qpfc

Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-53602

Packages

EcosystemPackageAffectedFixed in
Maven io.zipkin:zipkin-server <= 3.5.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use of Spring Boot Actuator), a similar issue to CVE-2025-48927.

References

External links from the advisory. They lead to third-party sites.