Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages

보통 4.3CVE-2025-41254 · GHSA-7fch-4f2f-jcgm · Published 16/10/2025 · updated 09/10/2026

요약

CVE-2025-41254은(는) org.springframework:spring-websocket에 영향을 주는 보통 (CVSS 4.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.31%, 전체 취약점의 24.3%보다 높음.
조치: 6.2.12 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
org.springframework:spring-websocket Maven	`≥ 6.0.0, ≤ 6.0.23≥ 6.1.0, ≤ 6.1.21≥ 6.2.0, < 6.2.12≤ 5.3.39`	`6.2.12`

Description

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.

Affected Spring Products and Versions

Spring Framework:

6.2.0 - 6.2.11
6.1.0 - 6.1.23
6.0.x - 6.0.29
5.3.0 - 5.3.45
Older, unsupported versions are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)

Fix version	Availability
6.2.x	6.2.12 OSS
6.1.x	6.1.24 Commercial https://enterprise.spring.io/
6.0.x	N/A Out of support https://spring.io/projects/spring-framework#support
5.3.x	5.3.46 Commercial https://enterprise.spring.io/

No further mitigation steps are necessary.

CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.

NVD description

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: * 6.2.0 - 6.2.11 * 6.1.0 - 6.1.23 * 6.0.x - 6.0.29 * 5.3.0 - 5.3.45 * Older, unsupported versions are also affected. MitigationUsers of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix versionAvailability6.2.x6.2.12OSS6.1.x6.1.24 Commercial https://enterprise.spring.io/ 6.0.xN/A Out of support https://spring.io/projects/spring-framework#support 5.3.x5.3.46 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.

References

nvd.nist.gov/vuln/detail/CVE-2025-41254 · ADVISORY
spring-projects/spring-framework · PACKAGE
nvd.nist.gov/vuln-metrics/cvss/v3-calculator · WEB
spring.io/security/cve/2025-41254 · WEB

org.springframework:spring-websocket의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.springframework:spring-websocket

Maven

≥ 6.0.0, ≤ 6.0.23≥ 6.1.0, ≤ 6.1.21≥ 6.2.0, < 6.2.12≤ 5.3.39

6.2.12

Description

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.

Affected Spring Products and Versions

Spring Framework:

6.2.0 - 6.2.11
6.1.0 - 6.1.23
6.0.x - 6.0.29
5.3.0 - 5.3.45
Older, unsupported versions are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)

Fix version	Availability
6.2.x	6.2.12 OSS
6.1.x	6.1.24 Commercial https://enterprise.spring.io/
6.0.x	N/A Out of support https://spring.io/projects/spring-framework#support
5.3.x	5.3.46 Commercial https://enterprise.spring.io/

No further mitigation steps are necessary.

CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.

NVD description