CVE-2018-1270: Spring Framework STOMP over WebSocket Remote Code Execution
Summary
CVE-2018-1270: Spring Framework allows applications to expose STOMP over WebSocket endpoints. Affects org.springframework:spring-messaging across 2 version ranges.
< 4.3.16.RELEASE
>= 5.0.0.RELEASE, < 5.0.5.RELEASE
Fixed in 4.3.16.RELEASE or 5.0.5.RELEASE, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2018-1270 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a popular Java application framework that provides comprehensive infrastructure support for developing Java applications. It includes various modules, such as spring-core, which provides core utilities and features for the framework. One of the features offered by the Spring Framework is the ability to expose STOMP (Simple Text Oriented Messaging Protocol) over WebSocket endpoints. STOMP is a messaging protocol that enables communication between clients and servers over WebSocket connections. The spring-messaging module in the Spring Framework allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker. This vulnerability affects versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15, as well as older unsupported versions.
Vulnerability Detail
The vulnerability in the Spring Framework allows a malicious user or attacker to craft a message to the in-memory STOMP broker, leading to a remote code execution attack. By exploiting this vulnerability, an attacker can execute arbitrary code on the server hosting the vulnerable application. This can result in unauthorized access, data breaches, and potential compromise of the entire system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.3.16.RELEASE4.3.16.RELEASE -
>= 5.0.0.RELEASE, < 5.0.5.RELEASE5.0.5.RELEASE
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a possible workaround is to disable the STOMP over WebSocket functionality in the application. This can be achieved by modifying the application configuration or code to remove the STOMP over WebSocket endpoints. However, this workaround may impact the functionality of the application if it relies on STOMP over WebSocket for communication.
Conclusion
The vulnerability in the Spring Framework that allows remote code execution through STOMP over WebSocket endpoints is a critical security issue. It is crucial to upgrade to a fixed version of the Spring Framework or disable the affected functionality to mitigate the risk. Regularly updating the framework and staying informed about security vulnerabilities is essential for maintaining the security of applications.
See every vulnerability recorded for org.springframework:spring-messaging →
FAQ
The Spring Framework is a Java application framework that provides infrastructure support for developing Java applications. It includes various modules and features for building robust and scalable applications.
STOMP (Simple Text Oriented Messaging Protocol) is a messaging protocol that enables communication between clients and servers over WebSocket connections. It provides a simple and interoperable way for applications to exchange messages.
The vulnerability occurs due to a flaw in the implementation of the STOMP over WebSocket functionality in the Spring Framework. A malicious user or attacker can exploit this flaw by crafting a message to the in-memory STOMP broker, leading to a remote code execution attack.
The vulnerability can allow an attacker to execute arbitrary code on the server hosting the vulnerable application. This can result in unauthorized access, data breaches, and potential compromise of the entire system.
To fix this vulnerability, it is recommended to upgrade to a fixed version of the Spring Framework. For versions 5.0, upgrade to version 5.0.5 or later. For versions 4.3, upgrade to version 4.3.16 or later. Regularly updating the Spring Framework is also important to apply the latest security patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-messaging.
