En resumen
- CVE-2025-41254 es una vulnerabilidad MEDIO (CVSS 4.3) que afecta a org.springframework:spring-websocket.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.31%, mayor que el 24.3% de las vulnerabilidades.
- Solución: actualizar a 6.2.12 o posterior.
Description
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.
Affected Spring Products and Versions
Spring Framework:
- 6.2.0 - 6.2.11
- 6.1.0 - 6.1.23
- 6.0.x - 6.0.29
- 5.3.0 - 5.3.45
- Older, unsupported versions are also affected.
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
Affected version(s)
No further mitigation steps are necessary.
CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.
NVD description
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.
Affected Spring Products and VersionsSpring Framework:
* 6.2.0 - 6.2.11
* 6.1.0 - 6.1.23
* 6.0.x - 6.0.29
* 5.3.0 - 5.3.45
* Older, unsupported versions are also affected.
MitigationUsers of affected versions should upgrade to the corresponding fixed version.
Affected version(s)Fix versionAvailability6.2.x6.2.12OSS6.1.x6.1.24 Commercial https://enterprise.spring.io/ 6.0.xN/A Out of support https://spring.io/projects/spring-framework#support 5.3.x5.3.46 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary.
CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.
Más vulnerabilidades de org.springframework:spring-websocket
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free