CVE-2018-1275: Improperly Implemented Security Check for Standard in org.springframework:spring-core
Summary
CVE-2018-1275: Spring Framework has Improperly Implemented Security Check for Standard. Affects org.springframework:spring-messaging across 2 version ranges.
< 4.3.16.RELEASE
>= 5.0.0.RELEASE, < 5.0.5.RELEASE
Fixed in 4.3.16.RELEASE or 5.0.5.RELEASE, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The org.springframework:spring-core package is a part of the Spring Framework, which is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The spring-core module is a core component of the Spring Framework and provides essential features such as dependency injection and inversion of control. This vulnerability affects versions 4.3 prior to 4.3.16 and versions 5.0 prior to 5.0.5 of the spring-core package.
Vulnerability Detail
The vulnerability arises from the improper implementation of a security check for the Standard (STOMP) protocol over WebSocket endpoints. The affected versions of the Spring Framework allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user can exploit this vulnerability by crafting a specific message to the broker, leading to a remote code execution attack. This vulnerability partially fixes a previous vulnerability (CVE-2018-1270) in the 4.3.x branch of the Spring Framework. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 9.8, indicating its critical severity.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.3.16.RELEASE4.3.16.RELEASE -
>= 5.0.0.RELEASE, < 5.0.5.RELEASE5.0.5.RELEASE
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, if upgrading to the fixed versions is not immediately feasible, you can consider disabling the STOMP over WebSocket endpoints or implementing additional security measures to mitigate the risk of exploitation. However, it is strongly advised to update to the fixed versions as soon as possible.
Conclusion
The vulnerability in the org.springframework:spring-core package exposes applications to potential remote code execution attacks. To mitigate this risk, it is recommended to update to the fixed versions of the Spring Framework (4.3.16 or higher for the 4.3.x branch and 5.0.5 or higher for the 5.0.x branch). Additionally, disabling the STOMP over WebSocket endpoints or implementing additional security measures can serve as temporary workarounds. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-messaging →
FAQ
This vulnerability can allow a malicious user to execute remote code on the affected system, potentially leading to unauthorized access, data breaches, or further compromise of the system.
No, only versions 4.3 prior to 4.3.16 and versions 5.0 prior to 5.0.5 of the spring-core package are affected. Other versions are not vulnerable to this specific issue.
While specific exploits for this vulnerability have not been disclosed publicly, it is important to promptly update to the fixed versions to mitigate the risk of potential exploitation.
Yes, this vulnerability can be exploited remotely by sending a crafted message to the STOMP broker exposed by the affected application.
There is no publicly available evidence of active exploitation at the time of this advisory. However, it is crucial to apply the necessary updates to protect against potential future attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-messaging.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
