Spring Security Advisories

RSS feed

CVE-2025-41254: Spring Framework STOMP CSRF Vulnerability

MEDIUM | OCTOBER 16, 2025 | CVE-2025-41254

Description

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.

Affected Spring Products and Versions

Spring Framework:

  • 6.2.0 - 6.2.11
  • 6.1.0 - 6.1.23
  • 6.0.x - 6.0.29
  • 5.3.0 - 5.3.45
  • Older, unsupported versions are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s) Fix version Availability
6.2.x 6.2.12 OSS
6.1.x 6.1.24 Commercial
6.0.x N/A Out of support
5.3.x 5.3.46 Commercial

No further mitigation steps are necessary.

Credit

This vulnerability was discovered and responsibly reported by Jannis Kaiser.

References

History

  • 2025-10-16: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all