PT-2025-42473 · Vmware+1 · Spring Framework+1

Published 2025-10-16 · Updated 2026-04-23 · CVE-2025-41254

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spring Framework versions 5.3.0 through 5.3.45 Spring Framework versions 6.0.x through 6.0.29 Spring Framework versions 6.1.0 through 6.1.23 Spring Framework versions 6.2.0 through 6.2.11

Description STOMP over WebSocket applications may allow an attacker to send unauthorized messages due to a security bypass. The issue affects Spring Framework applications utilizing STOMP.

Recommendations Upgrade to Spring Framework version 6.2.12. Upgrade to Spring Framework version 6.1.24. No further mitigation steps are necessary for version 5.3.x after upgrading to version 5.3.46.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CLEANSTART-2026-IS05941

CVE-2025-41254

GHSA-7FCH-4F2F-JCGM

Affected Products

Debian

Spring Framework

References · 63

• https://nvd.nist.gov/vuln/detail/CVE-2026-22735 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1225 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4926 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-41254 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-41254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34487 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66614 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34483 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22737 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29145 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-IS05941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33870 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-41254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7962 · Security Note
• https://osv.dev/vulnerability/GHSA-7fch-4f2f-jcgm · Vendor Advisory