Skip to content
Sign in
4.3 Medium

CVE-2025-41254 STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized…

Description

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: * 6.2.0 - 6.2.11 * 6.1.0 - 6.1.23 * 6.0.x - 6.0.29 * 5.3.0 - 5.3.45 * Older, unsupported versions are also affected. MitigationUsers of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix versionAvailability6.2.x6.2.12OSS6.1.x6.1.24 Commercial https://enterprise.spring.io/ 6.0.xN/A Out of support https://spring.io/projects/spring-framework#support 5.3.x5.3.46 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.

Affected products and versions

Product Affected versions Fixed in
Spring Framework 6.2.x No fix stated
Spring Framework 6.1.x No fix stated
Spring Framework 6.0.x No fix stated
Spring Framework 5.3.x No fix stated

Other CVEs of Spring Framework

The 7 CVEs of Spring Framework →
CVE-2026-22745 Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources 5.3 Medium CVE-2026-22741 Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources 3.1 Low CVE-2026-22740 A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K 6.5 Medium CVE-2025-41249 The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type… 7.5 High
Track this CVE