{"id":"CVE-2025-31129","summary":"jooby-pac4j: deserialization of untrusted data","details":"Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. This vulnerability is fixed in 2.17.0 (2.x) and 3.7.0 (3.x).","aliases":["GHSA-7c5v-895v-w4q5"],"modified":"2026-08-12T15:13:49.377463Z","published":"2025-03-31T19:10:57.599Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-502"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31129.json"},"references":[{"type":"WEB","url":"https://github.com/jooby-project/jooby/blob/v2.x/modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java#L39-L45"},{"type":"WEB","url":"https://github.com/jooby-project/jooby/blob/v3.6.1/modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java#L77-L84"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31129.json"},{"type":"ADVISORY","url":"https://github.com/jooby-project/jooby/security/advisories/GHSA-7c5v-895v-w4q5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31129"},{"type":"FIX","url":"https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jooby-project/jooby","events":[{"introduced":"f71b551213ac03523e44a7fbb8c972b752ffc707"},{"introduced":"0"},{"fixed":"b6655544cdbb1adb032710ba5a2867f2d9ea7f4b"},{"fixed":"5adecacc2ce8962bd6eb41a438c39404599c812a"},{"fixed":"3e13562cf36d7407813eae464e0f4b598de15692"}],"database_specific":{"extracted_events":[{"introduced":"3.0.0.M1"},{"fixed":"3.7.0"},{"introduced":"0"},{"fixed":"2.17.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v3.6.1","v3.6.0","v3.5.5","v3.5.4","v3.5.3","v3.5.1","v3.5.0","v3.4.3","v3.4.2","v3.4.0","v3.3.1","v3.3.0","v3.2.9","v3.2.8","v3.2.7","v3.2.6","v3.2.5","v3.2.4","v3.2.3","v3.1.3","v3.2.1","v3.2.0","v2.16.4","v3.1.2","v3.1.1","v3.1.0","v3.0.9","v3.0.7","v3.0.6","v3.0.5","v3.0.4","v3.0.3","v3.0.2","v3.0.1","v3.0.0.M11","v3.0.0.M10","v3.0.0.M9","v3.0.0.M8","v3.0.0.M7","v3.0.0.M6","v3.0.0.M4","v2.16.2","v3.0.0.M2","v3.0.0.M1","v2.16.1","v2.16.0","v2.15.1","v2.15.0","v2.14.2","v2.14.1","v2.14.0","v2.13.0","v2.12.0","v2.11.0","v2.10.0","v2.9.6","v2.9.5","v2.9.4","v2.9.3","v2.9.2","v2.9.1","v2.9.0","v2.8.10","v2.8.9","v2.8.8","v2.8.7","v2.8.6","v2.8.5","v2.8.4","v2.8.3","v2.8.2","v2.8.1","v2.8.0","v2.7.3","v2.7.2","v2.7.1","v2.7.0","v2.6.2","v2.6.0","v2.5.1","v2.5.0","v2.4.0","v2.3.1","v2.3.0","v2.2.1","v2.0.6","v2.0.5","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v2.0.0.RC3","v2.0.0.RC2","v2.0.0.RC1","v2.0.0.M3","v2.0.0.M2","v2.0.0.M1","v1.5.0","v1.4.1","v1.4.0","v1.3.0","v1.2.3","v1.2.2","v1.2.1","v1.2.0","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.3","v1.0.2","v1.0.1","v1.0.0","v1.0.0.CR8","v1.0.0.CR7","v1.0.0.CR6","v1.0.0.CR5","v1.0.0.CR4","v1.0.0.CR3","v1.0.0.CR2","v1.0.0.CR1","v0.16.0","v0.15.1","v0.15.0","v0.14.0","v0.11.2","v0.11.1","v0.11.0","v0.10.0","v0.9.2","v0.9.1","v0.9.0","v0.8.2","v0.8.0","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.3","v0.5.1","v0.5.0","v0.4.2","v0.4.1","v0.4.0","v0.3.0","v0.2.1","v0.2.0","v0.1.0"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692","target":{"file":"modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java","function":"get"},"deprecated":false,"digest":{"function_hash":"22103172719565429072734492610100682983","length":226},"id":"CVE-2025-31129-0d4694c2","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["140589967287573442472221437917398444873","169237869231236876048007438786037538086","271601337767602933166833169419367945157","153483475563234971535200492962480025968","242263341569860710422245341318528335098","323286864113777373415226563596757790492","42737818782396780590458137077441757512","183748885602467977146703383229899215374","335275660815587923656386316046644017567","235738788015189547796142003118504133003","88460065755744201155759792007064221117","256415989211074507352647207795242124280","284815667173322700278360025724863052434","37384301122761939056183482835746068764","147083983881617441771939417980474594005","195844477073241765003245302499755607845","173723720835927634661509725997996889835","213944742621640233736089943118415279252","203814363424300359410888880118617830756","73720468742668270685895582484144219088","184364756241048605426056316737491286164","95218523924057254290496610833147724666","339082736846423828486044975445309152312","117252441265804521187095441228042245517","28610938953619587964000823057406538314","115028391378495609208744521977882005539","124934794762947963860706034357365598611","150235152573569974655576656346043043937","43770502433415326257861619573433833429","5807435635515400515950657980656160749","17656536018238932916454740200512719657","41873432656088387907197128180511450365","336966136417386487495431914106629761042","219655555916411685587169876453334262276","103537675344744208229582234687442855936","253292082448594001758604946003051657434","321802980035377085855677032928948621917","288163037731306890458249504531586825390","220905334218852055207573196157178317303","264471421229511441918838213563130158035","327739560993902116963703518226636222019","185234916933396769605637248130705665004","294147942739055136568103729429156804168","121869850145000812412759549862402811353","315349347304778279325072113447750196222","108460981988997447238029678292671412883","285802545247583837808122178695645350831","252029585515529580265492586357664531995","107734566000076839159998333162661815092","207149234907166336767080707965943726629","166746498504808445300147211555515598986","333286962799850758648895181656689567241","54285190535845094106956053773141011949","294951545026456832246011607679537672979","54569618963599892667684129382653667241","282653875282798256118405075630323917646","256295145466981891448712124315385949300","155901624396824845169806987201477975877","101716226750970477882419727451582415610","58180596631904228846118154340458137345","60274565687188631638663675680662823016","30138338387488368567851783128859042327","290044176128610387116935430965538245775","318063721533006632045565755512567833635","245546805680426188759181369020523257957","32003524108198382500448852614112913717","94775167699410909496484574946844814060","124091268323659511958322623381872525684","151863134266897767710356810403260028149","106052957518488920875387296348304020947","83256083250457057660002996216376803692","11162130616839616985128165692426136852","221601350781113642336502838571104742250","30868806373303872021331024969015670443","13610029504632418965599776832255214846"],"threshold":0.9},"id":"CVE-2025-31129-2ab3a273","signature_type":"Line","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692","target":{"file":"modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java"}},{"digest":{"line_hashes":["41408011874278227741562776321554665818","239775418960902664797371355824535266927","114323683481957801989633636142223146216","222605559280497604336270371479862382004","182110380558097692394655145740973818503","145630584791386614287830596983796277501","65003705744811407752917078984389726039","38283648145793702231527530093188804752","161127834673224840724220655362078410507","226056649584723000939269324681004873175"],"threshold":0.9},"id":"CVE-2025-31129-34a8bbce","signature_type":"Line","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692","target":{"file":"modules/jooby-pac4j/src/main/java/io/jooby/pac4j/Pac4jOptions.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["104090181215554610785133596985074637272","228660450716642428729364183281704987412","279157261297859874788994743666685668082","278104452931124937161714800973933295805","107566325815256981598319022763614240703","86686343627282956967794000513715834072","314094439419713540831931087910739665562","71251816060014944656675743935734876867","331118287986384148456927509892955237770","115858418793085451701417400141485607656","46362656174773543461621529410905594866","171976425440222075230147826603425737618"],"threshold":0.9},"id":"CVE-2025-31129-49d2a8e4","signature_type":"Line","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692","target":{"file":"modules/jooby-pac4j/src/main/java/io/jooby/pac4j/Pac4jModule.java"}},{"signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692","target":{"file":"modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java","function":"objToStr"},"deprecated":false,"digest":{"function_hash":"79624876753497651265176805370288007878","length":486},"id":"CVE-2025-31129-58fc167a","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"45346967304949116402273742459560911478","length":297},"id":"CVE-2025-31129-bb74138e","signature_type":"Function","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692","target":{"file":"modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java","function":"set"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692","target":{"file":"modules/jooby-pac4j/src/main/java/module-info.java"},"deprecated":false,"digest":{"line_hashes":["308739028154995480611526688518290328902","324322417621660595233841725308421947182"],"threshold":0.9},"id":"CVE-2025-31129-ce04c584"},{"deprecated":false,"digest":{"function_hash":"97784723269369121632548977932882743310","length":615},"id":"CVE-2025-31129-dc9c18b8","signature_type":"Function","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692","target":{"file":"modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java","function":"strToObject"}},{"deprecated":false,"digest":{"function_hash":"142367602921354931098040661836232524727","length":5273},"id":"CVE-2025-31129-ddcabf4f","signature_type":"Function","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692","target":{"file":"modules/jooby-pac4j/src/main/java/io/jooby/pac4j/Pac4jModule.java","function":"install"}},{"target":{"function":"renewSession","file":"modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java"},"deprecated":false,"digest":{"function_hash":"192527292370989314038007699326651215795","length":118},"id":"CVE-2025-31129-f6ed7a44","signature_type":"Function","signature_version":"v1","source":"https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692"},{"source":"https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692","target":{"function":"setLogoutUrlPattern","file":"modules/jooby-pac4j/src/main/java/io/jooby/pac4j/Pac4jOptions.java"},"deprecated":false,"digest":{"function_hash":"188136250604559453682289204246208760068","length":57},"id":"CVE-2025-31129-fcd6a133","signature_type":"Function","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31129.json","vanir_signatures_modified":"2026-08-12T15:13:49Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}