CVE-2025-41249: Spring Framework Improper Authorization via Annotation Detection
Summary
CVE-2025-41249: Spring Framework annotation detection mechanism may result in improper authorization. Affects org.springframework:spring-core across 3 version ranges.
>= 5.3.0, <= 5.3.44
>= 6.0.0, <= 6.1.22
>= 6.2.0, < 6.2.11
No fix is published. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2025-41249 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a powerful framework for building Java applications, providing comprehensive infrastructure support for developing Java applications. It offers features such as dependency injection, aspect-oriented programming, and transaction management. However, the framework's annotation detection mechanism may lead to improper authorization when dealing with parameterized super types with unbounded generics, particularly when using Spring Security's @EnableMethodSecurity feature.
Vulnerability Detail
The vulnerability arises from the Spring Framework's annotation detection mechanism, which may fail to correctly resolve annotations on methods within type hierarchies that involve parameterized super types with unbounded generics. This misconfiguration can lead to unauthorized access if security annotations are applied to methods in generic superclasses or interfaces. Applications utilizing Spring Security's @EnableMethodSecurity feature are particularly at risk, as this may allow unauthorized users to execute sensitive operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider avoiding the use of security annotations on methods within generic superclasses or interfaces. This can help prevent unauthorized access until a proper update can be applied.
Conclusion
CVE-2025-41249 presents a significant risk for applications using the Spring Framework, particularly those employing Spring Security's @EnableMethodSecurity feature. It is crucial to update to the latest patched versions to ensure proper authorization and prevent unauthorized access.
See every vulnerability recorded for org.springframework:spring-core →
FAQ
CVE-2025-41249 is a vulnerability in the Spring Framework that may lead to improper authorization due to issues with the annotation detection mechanism.
Affected versions include Spring Framework 5.3.0 to 5.3.44, 6.0.0 to 6.1.22, and 6.2.0 to 6.2.10.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application's pom.xml using the Vulert playground at Vulert Scanner.
The CVSS score for CVE-2025-41249 is 7.5, indicating a high severity level.
As a temporary measure, avoid using security annotations on methods within generic superclasses or interfaces until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-core.
