Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.jooby:jooby-pac4j

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8MavenPublished

    jooby-pac4j: deserialization of untrusted data

    CVE-2025-31129 · GHSA-7c5v-895v-w4q5

    Affected
    • Maven io.jooby:jooby-pac4j < 2.17.0; >= 3.0.0.M1, < 3.7.0
    Fixed in
    2.17.03.7.0· Vendor fix available
    Issue
    Impact Versions after 2.x and before 3.x of io.jooby:jooby-pac4j can cause deserialization of untrusted data Patches - 2.17.0 (2.x) - 3.7.0 (3.x) Workarounds - Not using io.jooby:jooby-pac4j until it gets patches. - Check what values you put/save on session References Version 2.x: https://github.com/jooby-project/jooby/blob/v2.x/modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java#L39-L45 Version 3.x: https://github.com/jooby-project/jooby/blob/v3.6.1/modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java#L77-L84 Cause In module pac4j io.jooby.internal.pac4j.SessionStoreImpl#get , it is used to handle sessions , and trying to get key value. In strToObject function ,it's trying to deserialize value when value starts with "b64~" , which might cause deserialization of untrusted data. modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java Here's a small demo using SessionStoreImpl#get to handle sessions ,and…

    Recommended action: Upgrade to 3.7.0 or 2.17.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →