CVE-2025-31129
- Source
- https://cve.org/CVERecord?id=CVE-2025-31129
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31129.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-31129
- Aliases
- Published
- 2025-03-31T19:10:57.599Z
- Modified
- 2026-07-22T04:01:55.854408Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- jooby-pac4j: deserialization of untrusted data
- Details
-
Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. This vulnerability is fixed in 2.17.0 (2.x) and 3.7.0 (3.x).
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31129.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-502" ] }- References
-
- https://github.com/jooby-project/jooby/blob/v2.x/modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java#L39-L45
- https://github.com/jooby-project/jooby/blob/v3.6.1/modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java#L77-L84
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31129.json
- https://github.com/jooby-project/jooby/security/advisories/GHSA-7c5v-895v-w4q5
- https://nvd.nist.gov/vuln/detail/CVE-2025-31129
- https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692
Affected packages
Git / github.com/jooby-project/jooby
Affected ranges
- Type
- GIT
- Repo
- https://github.com/jooby-project/jooby
- Events
-
IntroducedIntroduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
{ "source": [ "AFFECTED_FIELD", "REFERENCES" ], "extracted_events": [ { "introduced": "3.0.0.M1" }, { "fixed": "3.7.0" }, { "introduced": "0" }, { "fixed": "2.17.0" } ] }
Affected versions
v0.*
v0.1.0
v0.10.0
v0.11.0
v0.11.1
v0.11.2
v0.14.0
v0.15.0
v0.15.1
v0.16.0
v0.2.0
v0.2.1
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.5.1
v0.5.3
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.6.4
v0.8.0
v0.8.2
v0.9.0
v0.9.1
v0.9.2
v1.*
v1.0.0
v1.0.0.CR1
v1.0.0.CR2
v1.0.0.CR3
v1.0.0.CR4
v1.0.0.CR5
v1.0.0.CR6
v1.0.0.CR7
v1.0.0.CR8
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.3.0
v1.4.0
v1.4.1
v1.5.0
v2.*
v2.0.0
v2.0.0.M1
v2.0.0.M2
v2.0.0.M3
v2.0.0.RC1
v2.0.0.RC2
v2.0.0.RC3
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.14.0
v2.14.1
v2.14.2
v2.15.0
v2.15.1
v2.16.0
v2.16.1
v2.16.2
v2.16.4
v2.2.1
v2.3.0
v2.3.1
v2.4.0
v2.5.0
v2.5.1
v2.6.0
v2.6.2
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v2.8.0
v2.8.1
v2.8.10
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.8.6
v2.8.7
v2.8.8
v2.8.9
v2.9.0
v2.9.1
v2.9.2
v2.9.3
v2.9.4
v2.9.5
v2.9.6
v3.*
v3.0.0.M1
v3.0.0.M10
v3.0.0.M11
v3.0.0.M2
v3.0.0.M4
v3.0.0.M6
v3.0.0.M7
v3.0.0.M8
v3.0.0.M9
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.9
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.2.0
v3.2.1
v3.2.3
v3.2.4
v3.2.5
v3.2.6
v3.2.7
v3.2.8
v3.2.9
v3.3.0
v3.3.1
v3.4.0
v3.4.2
v3.4.3
v3.5.0
v3.5.1
v3.5.3
v3.5.4
v3.5.5
v3.6.0
v3.6.1
Database specific
vanir_signatures
[
{
"digest": {
"length": 226.0,
"function_hash": "22103172719565429072734492610100682983"
},
"signature_version": "v1",
"source": "https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692",
"signature_type": "Function",
"target": {
"function": "get",
"file": "modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java"
},
"id": "CVE-2025-31129-0d4694c2",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"140589967287573442472221437917398444873",
"169237869231236876048007438786037538086",
"271601337767602933166833169419367945157",
"153483475563234971535200492962480025968",
"242263341569860710422245341318528335098",
"323286864113777373415226563596757790492",
"42737818782396780590458137077441757512",
"183748885602467977146703383229899215374",
"335275660815587923656386316046644017567",
"235738788015189547796142003118504133003",
"88460065755744201155759792007064221117",
"256415989211074507352647207795242124280",
"284815667173322700278360025724863052434",
"37384301122761939056183482835746068764",
"147083983881617441771939417980474594005",
"195844477073241765003245302499755607845",
"173723720835927634661509725997996889835",
"213944742621640233736089943118415279252",
"203814363424300359410888880118617830756",
"73720468742668270685895582484144219088",
"184364756241048605426056316737491286164",
"95218523924057254290496610833147724666",
"339082736846423828486044975445309152312",
"117252441265804521187095441228042245517",
"28610938953619587964000823057406538314",
"115028391378495609208744521977882005539",
"124934794762947963860706034357365598611",
"150235152573569974655576656346043043937",
"43770502433415326257861619573433833429",
"5807435635515400515950657980656160749",
"17656536018238932916454740200512719657",
"41873432656088387907197128180511450365",
"336966136417386487495431914106629761042",
"219655555916411685587169876453334262276",
"103537675344744208229582234687442855936",
"253292082448594001758604946003051657434",
"321802980035377085855677032928948621917",
"288163037731306890458249504531586825390",
"220905334218852055207573196157178317303",
"264471421229511441918838213563130158035",
"327739560993902116963703518226636222019",
"185234916933396769605637248130705665004",
"294147942739055136568103729429156804168",
"121869850145000812412759549862402811353",
"315349347304778279325072113447750196222",
"108460981988997447238029678292671412883",
"285802545247583837808122178695645350831",
"252029585515529580265492586357664531995",
"107734566000076839159998333162661815092",
"207149234907166336767080707965943726629",
"166746498504808445300147211555515598986",
"333286962799850758648895181656689567241",
"54285190535845094106956053773141011949",
"294951545026456832246011607679537672979",
"54569618963599892667684129382653667241",
"282653875282798256118405075630323917646",
"256295145466981891448712124315385949300",
"155901624396824845169806987201477975877",
"101716226750970477882419727451582415610",
"58180596631904228846118154340458137345",
"60274565687188631638663675680662823016",
"30138338387488368567851783128859042327",
"290044176128610387116935430965538245775",
"318063721533006632045565755512567833635",
"245546805680426188759181369020523257957",
"32003524108198382500448852614112913717",
"94775167699410909496484574946844814060",
"124091268323659511958322623381872525684",
"151863134266897767710356810403260028149",
"106052957518488920875387296348304020947",
"83256083250457057660002996216376803692",
"11162130616839616985128165692426136852",
"221601350781113642336502838571104742250",
"30868806373303872021331024969015670443",
"13610029504632418965599776832255214846"
]
},
"signature_version": "v1",
"source": "https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692",
"signature_type": "Line",
"target": {
"file": "modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java"
},
"id": "CVE-2025-31129-2ab3a273",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"41408011874278227741562776321554665818",
"239775418960902664797371355824535266927",
"114323683481957801989633636142223146216",
"222605559280497604336270371479862382004",
"182110380558097692394655145740973818503",
"145630584791386614287830596983796277501",
"65003705744811407752917078984389726039",
"38283648145793702231527530093188804752",
"161127834673224840724220655362078410507",
"226056649584723000939269324681004873175"
]
},
"signature_version": "v1",
"source": "https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692",
"signature_type": "Line",
"target": {
"file": "modules/jooby-pac4j/src/main/java/io/jooby/pac4j/Pac4jOptions.java"
},
"id": "CVE-2025-31129-34a8bbce",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"104090181215554610785133596985074637272",
"228660450716642428729364183281704987412",
"279157261297859874788994743666685668082",
"278104452931124937161714800973933295805",
"107566325815256981598319022763614240703",
"86686343627282956967794000513715834072",
"314094439419713540831931087910739665562",
"71251816060014944656675743935734876867",
"331118287986384148456927509892955237770",
"115858418793085451701417400141485607656",
"46362656174773543461621529410905594866",
"171976425440222075230147826603425737618"
]
},
"signature_version": "v1",
"source": "https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692",
"signature_type": "Line",
"target": {
"file": "modules/jooby-pac4j/src/main/java/io/jooby/pac4j/Pac4jModule.java"
},
"id": "CVE-2025-31129-49d2a8e4",
"deprecated": false
},
{
"digest": {
"length": 486.0,
"function_hash": "79624876753497651265176805370288007878"
},
"signature_version": "v1",
"source": "https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692",
"signature_type": "Function",
"target": {
"function": "objToStr",
"file": "modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java"
},
"id": "CVE-2025-31129-58fc167a",
"deprecated": false
},
{
"digest": {
"length": 297.0,
"function_hash": "45346967304949116402273742459560911478"
},
"signature_version": "v1",
"source": "https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692",
"signature_type": "Function",
"target": {
"function": "set",
"file": "modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java"
},
"id": "CVE-2025-31129-bb74138e",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"308739028154995480611526688518290328902",
"324322417621660595233841725308421947182"
]
},
"signature_version": "v1",
"source": "https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692",
"signature_type": "Line",
"target": {
"file": "modules/jooby-pac4j/src/main/java/module-info.java"
},
"id": "CVE-2025-31129-ce04c584",
"deprecated": false
},
{
"digest": {
"length": 615.0,
"function_hash": "97784723269369121632548977932882743310"
},
"signature_version": "v1",
"source": "https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692",
"signature_type": "Function",
"target": {
"function": "strToObject",
"file": "modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java"
},
"id": "CVE-2025-31129-dc9c18b8",
"deprecated": false
},
{
"digest": {
"length": 5273.0,
"function_hash": "142367602921354931098040661836232524727"
},
"signature_version": "v1",
"source": "https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692",
"signature_type": "Function",
"target": {
"function": "install",
"file": "modules/jooby-pac4j/src/main/java/io/jooby/pac4j/Pac4jModule.java"
},
"id": "CVE-2025-31129-ddcabf4f",
"deprecated": false
},
{
"digest": {
"length": 118.0,
"function_hash": "192527292370989314038007699326651215795"
},
"signature_version": "v1",
"source": "https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692",
"signature_type": "Function",
"target": {
"function": "renewSession",
"file": "modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java"
},
"id": "CVE-2025-31129-f6ed7a44",
"deprecated": false
},
{
"digest": {
"length": 57.0,
"function_hash": "188136250604559453682289204246208760068"
},
"signature_version": "v1",
"source": "https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692",
"signature_type": "Function",
"target": {
"function": "setLogoutUrlPattern",
"file": "modules/jooby-pac4j/src/main/java/io/jooby/pac4j/Pac4jOptions.java"
},
"id": "CVE-2025-31129-fcd6a133",
"deprecated": false
}
]
vanir_signatures_modified
"2026-07-22T04:01:55Z"
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31129.json"