[CVE-2025-22235] HIGH: spring-boot 3.3.7 - EndpointRequest.to() wrong matcher

[nthmost-orkes]

Vulnerability Report

Field	Value
CVE	CVE-2025-22235
Severity	HIGH
Library	org.springframework.boot:spring-boot
Source	workers.jar
Installed Version	3.3.7
Fixed Version	3.3.11, 3.4.5

Summary

Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed.

References

• NVD Entry

---

Filed from container vulnerability scan of workers.jar

[nthmost-orkes]

Fix PRs:

• Bump spring-boot-starter from 3.3.0 to 3.3.11 #86 (spring-boot-starter 3.3.0 -> 3.3.11)
• Security: Bump Spring Boot and pin vulnerable transitive dependencies conductor#800 (Spring Boot 3.3.5 -> 3.3.11)
• Bump Spring Boot from 3.1.4 to 3.3.11 conductor-task-update#1 (Spring Boot 3.1.4 -> 3.3.11)