Spring Framework Annotation Detection Vulnerability in libspring-java
Summary
CVE-2025-41249: The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. Affects libspring-java versions 4.3.30-1 – 4.3.30-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a core component of the Spring Framework, which is widely used for building Java applications. It provides essential features such as dependency injection, aspect-oriented programming, and transaction management. This package is crucial for developers utilizing Spring Security, particularly when implementing method-level security annotations. However, it is susceptible to a vulnerability that affects the annotation detection mechanism, especially in complex type hierarchies.
Vulnerability Detail
The vulnerability arises from the Spring Framework's annotation detection mechanism, which may fail to correctly resolve annotations on methods within type hierarchies that involve parameterized super types with unbounded generics. This flaw can lead to improper authorization decisions if security annotations are applied to methods in generic superclasses or interfaces. Applications using Spring Security's @EnableMethodSecurity feature are particularly at risk, while those not utilizing this feature or security annotations in generic contexts remain unaffected.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using security annotations on methods that are part of generic superclasses or interfaces. This will help mitigate the risk until a patch is applied.
Conclusion
The CVE-2025-41249 vulnerability in the libspring-java package poses a significant risk to applications utilizing Spring Security's method-level security features. It is crucial for developers to update their packages to the latest versions and consider workarounds to mitigate potential security issues until a patch is applied.
See every vulnerability recorded for libspring-java →
FAQ
CVE-2025-41249 is a vulnerability in the Spring Framework that affects the annotation detection mechanism, potentially leading to improper authorization decisions.
Applications using Spring Security's @EnableMethodSecurity feature and employing security annotations on methods in generic superclasses or interfaces are at risk.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, refrain from using security annotations on methods in generic superclasses or interfaces as a temporary workaround.
More details can be found in the official Spring Security announcement at https://spring.io/security/cve-2025-41248.
References
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
