CVE-2025-53602: Zipkin Information Disclosure Flaw

CVE-2025-53602 Overview

CVE-2025-53602 affects Zipkin, an open-source distributed tracing system used to troubleshoot latency issues in microservice architectures. Versions through 3.5.1 expose a /heapdump endpoint associated with Spring Boot Actuator. Unauthenticated network attackers can request the endpoint and retrieve a Java heap dump containing sensitive runtime data. The issue mirrors CVE-2025-48927 and is classified under CWE-1188 (Insecure Default Initialization of Resource).

Critical Impact
Unauthenticated attackers can download full JVM heap dumps from exposed Zipkin instances, potentially leaking session tokens, credentials, and in-memory application secrets.

Affected Products

OpenZipkin Zipkin versions through 3.5.1
Zipkin deployments using Spring Boot Actuator with default endpoint exposure
Any environment exposing the Zipkin management interface to untrusted networks

Discovery Timeline

2025-07-04 - CVE-2025-53602 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53602

Vulnerability Analysis

Zipkin ships with Spring Boot Actuator management endpoints enabled. The /heapdump endpoint returns a binary snapshot of the JVM heap in HPROF format when requested. In vulnerable Zipkin builds through 3.5.1, this endpoint is accessible without authentication over the network.

Heap dumps contain the full contents of application memory at the time of capture. Attackers can parse the dump offline using tools such as Eclipse MAT or jhat to extract HTTP session identifiers, database connection strings, API keys, JWT signing material, and cached request data. The endpoint also allows repeated invocation, which can drive memory pressure and degrade service.

Root Cause

The root cause is insecure default initialization of Spring Boot Actuator management endpoints in Zipkin's distribution. The /heapdump endpoint was exposed on the primary HTTP listener rather than a restricted management port, and no authentication filter guarded the actuator surface. This matches the pattern flagged in CWE-1188 where a product ships with a resource configured in a state that is not safe for production.

Attack Vector

Exploitation requires only network reachability to the Zipkin HTTP port. An attacker issues a single GET /heapdump request and receives the HPROF file in the response body. No credentials, user interaction, or elevated privileges are needed. Because Zipkin is frequently deployed inside internal observability tiers, a foothold on any adjacent workload is often sufficient to reach the endpoint.

The upstream fix landed in openzipkin/zipkin pull request #3804 and commit 3c7605d, which disables the sensitive actuator endpoints by default.

Detection Methods for CVE-2025-53602

Indicators of Compromise

HTTP GET requests to /heapdump, /actuator/heapdump, or /manage/heapdump against Zipkin hosts
Large binary HTTP responses (typically hundreds of megabytes) originating from the Zipkin listener port
Requests to Zipkin management paths from source IPs outside the observability subnet
Repeated /heapdump invocations within a short interval, indicating scraping or DoS behavior

Detection Strategies

Alert on any successful 2xx response to /heapdump in web server, ingress, or reverse proxy access logs
Fingerprint Zipkin services on the network and enumerate exposed actuator endpoints using authenticated scans
Correlate outbound egress spikes from Zipkin hosts with prior /heapdump requests to identify data exfiltration

Monitoring Recommendations

Ship Zipkin access logs and JVM metrics to a centralized SIEM for retention and analytics
Monitor JVM heap size and process CPU on Zipkin nodes for anomalies consistent with heap dump generation
Track network flows to Zipkin management ports and baseline expected client identities

How to Mitigate CVE-2025-53602

Immediate Actions Required

Upgrade Zipkin to a release that includes the fix from pull request #3804
Block external and lateral access to the Zipkin HTTP port at the network or ingress layer
Audit historical access logs for prior /heapdump requests and rotate any secrets that may have been in memory

Patch Information

The upstream patch is available in commit 3c7605dfdfab2dd341cf0ea121a56cefcd580d9e. The change disables sensitive Spring Boot Actuator endpoints, including heapdump, by default. Update to the first Zipkin release built from that commit or later.

Workarounds

Set management.endpoint.heapdump.enabled=false and restrict management.endpoints.web.exposure.include to a minimal set
Bind the actuator surface to a separate management port only reachable from an operations network
Place Zipkin behind a reverse proxy that denies requests matching /heapdump and other actuator paths

bash

# application.yml hardening for Spring Boot Actuator on Zipkin
management:
  server:
    port: 9091
    address: 127.0.0.1
  endpoints:
    web:
      exposure:
        include: health,info
  endpoint:
    heapdump:
      enabled: false
    threaddump:
      enabled: false