Skip to content
OpenAdvisories
Medium · 5.3 CVE-2025-53602 EUVD-2025-20090GHSA-794x-8x6x-qpfc

Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint

Published Jul 4, 2025 · Updated Jul 8, 2025 · Assigned by mitre

Vendor: Open Zipkin Product: zipkin Package: io.zipkin:zipkin-server Ecosystem: Maven

Description

Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use of Spring Boot Actuator), a similar issue to CVE-2025-48927.

Affected products

VendorProductAffectedFixed
Open Zipkin Zipkin ≤ 3.5.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.zipkin:zipkin-server <= 3.5.1 — GHSA-794x-8x6x-qpfc

References