io.jooby vulnerabilities

Products

• io.jooby/jooby 1
• io.jooby/jooby-netty 1
• io.jooby/jooby-pac4j 1

Latest io.jooby CVEs

Newest publication first

1. CVE-2020-7647 path traversal in Jooby

   Published 2020-05-11

   Medium·CVSS 5.3 EPSS 1.6%

   All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors.

2. CVE-2020-7622 Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)

   Published 2020-04-06

   Critical·CVSS 9.8 EPSS 1.6%

   This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.

3. CVE-2025-31129 jooby-pac4j: deserialization of untrusted data

   High·CVSS 8.8

   Impact Versions after 2.x and before 3.x of io.jooby:jooby-pac4j can cause deserialization of untrusted data Patches 2.17.0 (2.x) 3.7.0 (3.x) Workarounds Not using io.jooby:jooby-pac4j until it gets patches. Check what values you put/save on session References Version 2.x: https:...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.