Log in Start free

Vulnerability · Published Sep 16, 2025 · Assigned by vmware

CVE-2025-41249CVE-2025-41249: Spring Framework Annotation Detection Vulnerability

High 7.5

In plain English

A high-severity security flaw in Spring Framework from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 58.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions. Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction with CVE-2025-41248 https://spring.io/security/cve-2025-41248 .

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2025-41249
Debian:13libspring-javano fix listedDEBIAN-CVE-2025-41249
Debian:14libspring-javano fix listedDEBIAN-CVE-2025-41249
Mavenorg.springframework:spring-coreno fix listedGHSA-jmp9-x22r-554x
Mavenorg.springframework:spring-coreno fix listedGHSA-jmp9-x22r-554x
Mavenorg.springframework:spring-core6.2.11GHSA-jmp9-x22r-554x
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2025-41249
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2025-41249
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2025-41249

Affected products (as reported)

VendorProductVersions
VMware Spring Framework 6.2.x – before 6.2.116.1.x – before 6.1.235.3.x – before 5.3.45

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References