Unauthorized Message Sending Vulnerability in libspring-java Package
Summary
DEBIAN-CVE-2025-41254: STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affects libspring-java versions 4.3.30-1 – 4.3.30-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libspring-java package is a core component of the Spring Framework, which is widely used for building enterprise-level applications in Java. It provides comprehensive infrastructure support for developing Java applications, including features for web applications, data access, and messaging. However, certain versions of this package are vulnerable to a security bypass that allows unauthorized message sending over STOMP (Simple Text Oriented Messaging Protocol) when used with WebSocket applications.
Vulnerability Detail
The vulnerability identified as CVE-2025-41254 allows attackers to send unauthorized messages in STOMP over WebSocket applications. This issue arises from improper validation mechanisms within the affected versions of the Spring Framework, specifically versions 6.2.0 to 6.2.11, 6.1.0 to 6.1.23, 6.0.x up to 6.0.29, and 5.3.0 to 5.3.45. The ramifications of this vulnerability can lead to unauthorized access and manipulation of messaging data, potentially compromising application integrity and user data security. It is crucial for users of these versions to take immediate action to mitigate the risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No further mitigation steps are necessary beyond upgrading to the fixed versions mentioned above.
Conclusion
The libspring-java package has a significant vulnerability (CVE-2025-41254) that allows unauthorized message sending in STOMP over WebSocket applications. Users are urged to upgrade to the patched versions to secure their applications against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libspring-java →
FAQ
CVE-2025-41254 is a vulnerability in the libspring-java package that allows unauthorized message sending in STOMP over WebSocket applications.
Affected versions include 6.2.0 to 6.2.11, 6.1.0 to 6.1.23, 6.0.x up to 6.0.29, and 5.3.0 to 5.3.45.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.3, indicating a moderate level of risk.
While no specific workarounds are provided, it is highly recommended to prioritize upgrading to the fixed versions as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
