A Spring Boot heapdump is a debug export, but it can hand out the secrets that keep the app connected to other systems. If an attacker can fetch it, patching the web endpoint later does not undo the credential leak already sitting in memory.
SANS saw scans against the Spring Boot heapdump path at /admin-api/actuator/heapdump, using default admin credentials. The dump can include API keys, database passwords, and other live secrets, so the blast radius reaches databases and APIs behind the web tier, not just the management URL itself.