CVE-2025-41254

Name of the Vulnerable Software and Affected Versions Spring Framework versions 5.3.0 through 5.3.45 Spring Framework versions 6.0.x through 6.0.29 Spring Framework versions 6.1.0 through 6.1.23 Spring Framework versions 6.2.0 through 6.2.11

Description STOMP over WebSocket applications may allow an attacker to send unauthorized messages due to a security bypass. The issue affects Spring Framework applications utilizing STOMP.

Recommendations Upgrade to Spring Framework version 6.2.12. Upgrade to Spring Framework version 6.1.24. No further mitigation steps are necessary for version 5.3.x after upgrading to version 5.3.46.