Vulnerability Directory | CVE-2025-41254 | Spring

Overview

Spring Framework is a comprehensive Java framework for building enterprise-level applications. It provides a powerful, flexible programming model that simplifies the development of web applications by allowing you to use Java as your primary language while offering a variety of tools to manage application configuration, data access, and security.

A CSRF vulnerability (CVE-2025-41254) has been identified in Spring Framework (spring-websocket in particular), which allows attackers to deliver payloads to WebSocket controllers without creating a session first. Bypassing this step could lead to anonymous users executing business code not meant to be reached without a session created.

Per OWASP: Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.

This issue affects multiple versions of Spring Framework spring-websocket.

‍

Details

Module Info

Product: Spring Framework
Affected packages: spring-websocket
Affected versions: >=6.2.0 < 6.2.12, >=6.1.0 < 6.1.24, >=6.0.0 <=6.0.29, >=5.3.0 < 5.3.46, <5.3.0, >4.3.0 <= 4.3.30
GitHub repository: https://github.com/spring-projects/spring-framework
Published packages: https://central.sonatype.com/artifact/org.springframework/spring-websocket
Package manager: Maven
Fixed In: NES for Spring Framework v4.3.36, v5.3.49, v6.1.25

‍

Vulnerability Info

This medium-severity vulnerability is found in the main spring-websocket package in all published versions of Spring Framework

While it’s technically possible to send messages (or subscribe) to a WebSocket endpoint without first initializing a session, the fix prevents that in order to protect users' sessions from CSRF.

‍

Mitigation

Only recent versions of Spring Framework are community-supported. Only the recent community supported version will receive updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations: