CVE-2025-31129
Published: 31 March 2025
Summary
CVE-2025-31129 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-31129 affects Jooby, a web framework for Java and Kotlin, specifically in the pac4j module's io.jooby.internal.pac4j.SessionStoreImpl#get function, which deserializes untrusted data. This deserialization flaw, mapped to CWE-502, impacts Jooby versions prior to 2.17.0 in the 2.x series and 3.7.0 in the 3.x series. Published on 2025-03-31, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to potential for significant impact.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity, though it requires user interaction, such as tricking a victim into triggering the deserialization process. Successful exploitation enables high confidentiality, integrity, and availability impacts, potentially allowing arbitrary code execution or other severe consequences typical of unsafe deserialization.
Mitigation is available through upgrades to Jooby 2.17.0 (2.x) or 3.7.0 (3.x), as detailed in the project's GitHub security advisory GHSA-7c5v-895v-w4q5 and fixing commit 3e13562cf36d7407813eae464e0f4b598de15692. Vulnerable code locations are visible in SessionStoreImpl.java at lines 39-45 (v2.x) and 77-84 (v3.6.1).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9309
Vulnerability details
Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. This vulnerability is fixed in 2.17.0 (2.x) and 3.7.0 (3.x).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unsafe deserialization (CWE-502) in public-facing Java web framework enables remote code execution via crafted network requests, directly mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of flaws like the unsafe deserialization in Jooby's SessionStoreImpl by upgrading to fixed versions 2.17.0 or 3.7.0.
Mandates validation of untrusted information inputs such as session data deserialized by SessionStoreImpl#get to block malicious payloads.
Enables vulnerability scanning to identify deployments of vulnerable Jooby versions affected by CVE-2025-31129 for remediation.