CVE-2025-41254: Spring Framework STOMP over WebSocket Applications Vulnerability
Summary
CVE-2025-41254: Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages. Affects org.springframework:spring-websocket across 4 version ranges.
< 5.3.39
>= 6.0.0, <= 6.0.23
>= 6.1.0, <= 6.1.21
>= 6.2.0, < 6.2.12
Fixed in 5.3.39 or 6.2.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a powerful framework for building Java applications, providing comprehensive infrastructure support for developing Java applications. The 'spring-websocket' module enables WebSocket support, allowing for full-duplex communication channels over a single TCP connection. This functionality is critical for real-time applications. However, certain versions of this module are vulnerable to a security bypass that can allow unauthorized message sending, posing significant risks to application integrity and user data.
Vulnerability Detail
The vulnerability arises from a flaw in the STOMP over WebSocket implementation within the Spring Framework, specifically in versions 6.2.0 to 6.2.11, 6.1.0 to 6.1.23, 6.0.x to 6.0.29, and 5.3.0 to 5.3.45. This flaw allows attackers to send unauthorized messages, potentially leading to data leakage or manipulation. The issue is classified under CWE-352, indicating a weakness in the security of the messaging protocol used in WebSocket applications.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.3.395.3.39 -
>= 6.2.0, < 6.2.126.2.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workarounds are mentioned for this vulnerability. The recommended action is to upgrade to the fixed versions as outlined above.
Conclusion
CVE-2025-41254 represents a significant security risk for applications using vulnerable versions of the Spring Framework's STOMP over WebSocket. Users are strongly advised to upgrade to the fixed versions to mitigate potential threats. Utilizing tools like Vulert can help in identifying vulnerabilities in your software effectively.
See every vulnerability recorded for org.springframework:spring-websocket →
FAQ
CVE-2025-41254 is a vulnerability in the Spring Framework's STOMP over WebSocket implementation that allows attackers to send unauthorized messages.
Affected versions include Spring Framework 6.2.0 to 6.2.11, 6.1.0 to 6.1.23, 6.0.x to 6.0.29, and 5.3.0 to 5.3.45.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. Visit Vulert Scanner to check your application without signup.
The CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
If upgrading is not possible, consider reviewing your application's security measures and monitoring for any suspicious activity, as no specific workarounds are provided.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-websocket.
