CVE-2025-22235

Summary

CVE-2025-22235 is a vulnerability affecting Spring Security where the EndpointRequest.to() method creates a matcher for null/** if the referenced endpoint is disabled or not exposed. This issue could put applications at risk if certain conditions are met, including the use of Spring Security, EndpointRequest.to() in a Spring Security chain configuration, a disabled or unexposed endpoint, and handling of requests to /null that require protection. Applications are not vulnerable if they don't use Spring Security, EndpointRequest.to(), or if the referenced endpoint is enabled and exposed, or if they don't handle requests to /null.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.