Bug 2404437 (CVE-2025-41254)

Summary:	CVE-2025-41254 org.springframework/spring-core: Spring Framework STOMP CSRF Vulnerability
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abrianik, aschwart, asoldano, ataylor, bbaranow, bmaxwell, boliveir, brian.stansberry, darran.lofthouse, dbruscin, dhanak, dkreling, dosoudil, drosa, fjuma, fmariani, ggrzybek, gmalinko, gtanzill, ibek, istudens, ivassile, iweiss, janstey, jbuscemi, jcantril, jrokos, kaycoth, kvanderr, kverlaen, mnovotny, mosmerov, mposolda, msochure, msvehla, nwallace, parichar, pbizzarr, pdelbell, pesilva, pjindal, pmackay, rojacob, rstancel, rstepani, sausingh, sdawley, smaestri, ssilvert, sthorger, tasato, tcunning, tom.jenkinson, vmuzikar, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A CSRF flaw has been discovered in the Spring Framework. Usage of the STOMP messaging protocol over a WebSocket based application may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2405391, 2405392, 2405393, 2405390
Bug Blocks:

Description OSIDB Bzimport 2025-10-16 15:01:34 UTC

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.

Affected Spring Products and VersionsSpring Framework:

  *  6.2.0 - 6.2.11
  *  6.1.0 - 6.1.23
  *  6.0.x - 6.0.29
  *  5.3.0 - 5.3.45
  *  Older, unsupported versions are also affected.


MitigationUsers of affected versions should upgrade to the corresponding fixed version.

Affected version(s)Fix versionAvailability6.2.x6.2.12OSS6.1.x6.1.24 Commercial https://enterprise.spring.io/ 6.0.xN/A Out of support https://spring.io/projects/spring-framework#support 5.3.x5.3.46 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary.

CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.