CVE-2025-31129
1 advisory.
Maven/io.jooby:jooby-pac4j CVE-2025-31129: high 8.8
jooby-pac4j: deserialization of untrusted data
Action: Upgrade io.jooby:jooby-pac4j to 2.17.0 (2.x) or 3.7.0 (3.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.17.0 | - |
| 3.0.0.M1 | 3.7.0 | - |
Fixed versions
| 2.17.0 | 3.7.0 |
Sources
- osv: GHSA-7c5v-895v-w4q5
- https://github.com/jooby-project/jooby/security/advisories/GHSA-7c5v-895v-w4q5
- https://nvd.nist.gov/vuln/detail/CVE-2025-31129
- https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692
- https://github.com/jooby-project/jooby
- https://github.com/jooby-project/jooby/blob/v2.x/modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java#L39-L45
- https://github.com/jooby-project/jooby/blob/v3.6.1/modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java#L77-L84
CVE-2025-31129 · published · modified · JSON