Spring Boot Dump Scanner
Summary: PortSwigger's BApp Store lists a third-party Burp extension called Spring Boot Dump Scanner, version 1.0.0, authored by Mukeshj008 and last updated 10 November 2025. The extension adds a scan check that detects publicly accessible Spring Boot actuator heapdump and threaddump endpoints, which expose memory dumps and thread states.
What you should know: An exposed heapdump hands over application memory contents to anyone who can reach the endpoint, and this check exists because those endpoints are being found in the wild. PortSwigger states it makes no warranty about the quality or usefulness of third-party extensions, so the finding still needs your own validation.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026