Bug 2395725 (CVE-2025-41249)

Summary: CVE-2025-41249 org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abrianik, aschwart, asoldano, aszczucz, ataylor, bbaranow, bmaxwell, boliveir, brian.stansberry, bstansbe, darran.lofthouse, dbruscin, dhanak, dkreling, dlofthou, dosoudil, drichtar, drosa, fmariani, ggrzybek, gmalinko, gtanzill, ibek, istudens, ivassile, iweiss, janstey, jbuscemi, jcantril, jraez, jrokos, jross, kaycoth, kvanderr, kverlaen, mnovotny, mosmerov, mposolda, msochure, msvehla, nwallace, parichar, pberan, pbizzarr, pdelbell, pesilva, pjindal, pmackay, rhel-process-autobot, rmartinc, rojacob, rstancel, rstepani, sausingh, sdawley, smaestri, ssilvert, sthorger, tasato, tcunning, thjenkin, tom.jenkinson, vdosoudi, vmuzikar, watson-tool-maintainers, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2395966, 2395967, 2395964, 2395965    
Bug Blocks:    

Description OSIDB Bzimport 2025-09-16 11:01:13 UTC 
The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.

Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.

You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.

This CVE is published in conjunction with  CVE-2025-41248 https://spring.io/security/cve-2025-41248 .
Comment 3 errata-xmlrpc 2025-10-14 17:59:16 UTC 
This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.10.7 for Spring Boot 3.4.10

Via RHSA-2025:18028 https://access.redhat.com/errata/RHSA-2025:18028