Zipkin Heap Dump Endpoint Exposure Vulnerability

A vulnerability exists in Zipkin versions through 3.5.1, where the /heapdump endpoint is exposed. This endpoint is associated with Spring Boot Actuator, and its availability can lead to unauthorized access to sensitive application memory data. The issue is similar to CVE-2025-48927.

Impact

Exposing the /heapdump endpoint can lead to unauthorized access to sensitive memory data, potentially allowing for further exploitation of the application.

Remediation

Users can disable the /heapdump endpoint by excluding the 'org.springframework.boot.actuate.autoconfigure.management.HeapDumpWebEndpointAutoConfiguration' configuration property. Instructions for modifying the Zipkin configuration are available in the Zipkin documentation.