CVE-2025-41254
1 advisory.
Maven/org.springframework:spring-websocket CVE-2025-41254: medium 4.3, EPSS 0.31%
Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages
Action: Upgrade org.springframework:spring-websocket to 6.2.12 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.2.0 | 6.2.12 | - |
| 6.1.0 | - | 6.1.21 |
| 6.0.0 | - | 6.0.23 |
| 0 | - | 5.3.39 |
Fixed versions
| 6.2.12 |
Sources
- osv: GHSA-7fch-4f2f-jcgm
- https://nvd.nist.gov/vuln/detail/CVE-2025-41254
- https://github.com/spring-projects/spring-framework
- https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N&version=3.1
- https://spring.io/security/cve/2025-41254
CVE-2025-41254 · published · modified · JSON