medium5.3
CVE-2025-53602
Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint
Impact
Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use of Spring Boot Actuator), a similar issue to CVE-2025-48927.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.zipkin:zipkin-server | <= 3.5.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zipkin | Zipkin | through 3.5.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/openzipkin/zipkin/commit/3c7605dfdfab2dd341cf0ea121a56cefcd580d9e
- https://github.com/openzipkin/zipkin/pull/3804
- https://zipkin.io/
- https://github.com/advisories/GHSA-794x-8x6x-qpfc
- https://nvd.nist.gov/vuln/detail/CVE-2025-53602
- https://zipkin.io