GitHub Advisoryadvisory · Maven
GHSA-794x-8x6x-qpfc Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint
MEDIUM
Official page ↗
- Aliases
- CVE-2025-53602
- Ecosystem
- Maven
- Packages
- io.zipkin:zipkin-server
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-1188
- Reviewed
- 2025-07-07
Affected packages
• Maven io.zipkin:zipkin-server: <= 3.5.1 (no fix yet)
Description
Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use of Spring Boot Actuator), a similar issue to CVE-2025-48927.
Related
Alias · CVE (1)
- CVE-2025-53602 Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use of Spring Boot Actuator), a similar issue to CVE-2025-48927. vulnerability
Weakness · CWE (1)
- CWE-1188 Initialization of a Resource with an Insecure Default weakness