Reflected File Download Vulnerability in libspring-java Package
Summary
UBUNTU-CVE-2025-41234: Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII c... Affects libspring-java versions 3.0.6.RELEASE-10 – 3.0.6.RELEASE-9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The libspring-java package is a core component of the Spring Framework, which provides comprehensive infrastructure support for developing Java applications. It includes various modules such as Spring AOP, Spring Beans, Spring Context, and more, enabling developers to build robust and scalable applications. However, certain versions of this package are vulnerable to a reflected file download (RFD) attack, which can lead to severe security breaches if exploited.
Vulnerability Detail
In Spring Framework versions 6.0.5 to 6.2.7, a reflected file download (RFD) vulnerability exists when the 'Content-Disposition' header is set with a non-ASCII charset, and the filename is derived from user-supplied input without proper sanitization. This flaw allows attackers to inject malicious commands into the downloaded content, potentially compromising user systems. The vulnerability arises from improper handling of user input in the ContentDisposition.Builder class, making it critical for developers to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, applications should avoid setting the 'Content-Disposition' header or ensure that the filename is not derived from user-supplied input. Additionally, developers can sanitize user inputs before using them in the filename attribute to mitigate the risk of RFD attacks.
Conclusion
The reflected file download vulnerability in the libspring-java package poses a significant risk to applications using affected versions. It is crucial for developers to upgrade to the patched versions to safeguard their applications against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libspring-java →
FAQ
A reflected file download (RFD) attack occurs when an attacker tricks a user into downloading a file that contains malicious content, often by manipulating the response headers of a web application.
The affected versions of libspring-java are 6.0.5 to 6.2.7. Users should check their installed version and upgrade if necessary.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Failing to address this vulnerability can lead to serious security breaches, including unauthorized access to sensitive data and potential system compromise.
Yes, you can temporarily mitigate the risk by avoiding the use of the 'Content-Disposition' header or by sanitizing user inputs before they are used in the filename attribute.
References
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
