CVE-2025-41254

Medium

Description

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: * 6.2.0 - 6.2.11 * 6.1.0 - 6.1.23 * 6.0.x - 6.0.29 * 5.3.0 - 5.3.45 * Older, unsupported versions are also affected. MitigationUsers of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix versionAvailability6.2.x6.2.12OSS6.1.x6.1.24 Commercial https://enterprise.spring.io/ 6.0.xN/A Out of support https://spring.io/projects/spring-framework#support 5.3.x5.3.46 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.

SeverityMedium

CVSS4.3

Exploit probability—

ProductOrg.springframework:spring-websocket

PublishedOct 16, 2025

First seenOct 16, 2025

Weakness typeCWE-352Cross-site request forgery (CSRF)

How to fix

Update

org.springframework:spring-websocket6.2.12 or later

Affected products

Product	Affected versions	Fixed in
org.springframework:spring-websocketMaven	6.2.0 ≤ v < 6.2.12, 6.1.0 ≤ v ≤ 6.1.21, 6.0.0 ≤ v ≤ 6.0.23, v ≤ 5.3.39	6.2.12

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.