Log in Start free

Vulnerability · Published Oct 16, 2025 · Assigned by vmware

CVE-2025-41254Spring Framework STOMP CSRF Vulnerability

Medium 4.3

In plain English

A medium-severity cross-site request forgery in Spring Framework from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 75.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: * 6.2.0 - 6.2.11 * 6.1.0 - 6.1.23 * 6.0.x - 6.0.29 * 5.3.0 - 5.3.45 * Older, unsupported versions are also affected. MitigationUsers of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix versionAvailability6.2.x6.2.12OSS6.1.x6.1.24 Commercial https://enterprise.spring.io/ 6.0.xN/A Out of support https://spring.io/projects/spring-framework#support 5.3.x5.3.46 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2025-41254
Debian:13libspring-javano fix listedDEBIAN-CVE-2025-41254
Debian:14libspring-javano fix listedDEBIAN-CVE-2025-41254
Mavenorg.springframework:spring-websocketno fix listedGHSA-7fch-4f2f-jcgm
Mavenorg.springframework:spring-websocket6.2.12GHSA-7fch-4f2f-jcgm
Mavenorg.springframework:spring-websocketno fix listedGHSA-7fch-4f2f-jcgm
Mavenorg.springframework:spring-websocketno fix listedGHSA-7fch-4f2f-jcgm
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2025-41254
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2025-41254
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2025-41254

Affected products (as reported)

VendorProductVersions
VMware Spring Framework 5.3.x6.0.x6.1.x6.2.x

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References