Aller au contenu
Se connecter
4.3 Moyenne

CVE-2025-41254 STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized…

Description

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: * 6.2.0 - 6.2.11 * 6.1.0 - 6.1.23 * 6.0.x - 6.0.29 * 5.3.0 - 5.3.45 * Older, unsupported versions are also affected. MitigationUsers of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix versionAvailability6.2.x6.2.12OSS6.1.x6.1.24 Commercial https://enterprise.spring.io/ 6.0.xN/A Out of support https://spring.io/projects/spring-framework#support 5.3.x5.3.46 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.

Produits et versions touchés

Produit Versions touchées Corrigé en
Spring Framework 6.2.x Pas de correctif indiqué
Spring Framework 6.1.x Pas de correctif indiqué
Spring Framework 6.0.x Pas de correctif indiqué
Spring Framework 5.3.x Pas de correctif indiqué

Autres CVE de Spring Framework

Les 7 CVE de Spring Framework →
CVE-2026-22745 Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources 5.3 Moyenne CVE-2026-22741 Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources 3.1 Faible CVE-2026-22740 A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K 6.5 Moyenne CVE-2025-41249 The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type… 7.5 Élevée
Suivre cette CVE