Spring Framework CVE-2025-41254

Exploitation requires the target application to use Spring's STOMP over WebSocket messaging support - applications not using STOMP/WebSocket are unaffected. The CVSS vector's UI:R means a victim must perform an action (e.g. visiting an attacker-controlled page) for the CSRF-style bypass to send unauthorized messages, which is the primary limiting factor. No attacker privileges are required (PR:N), but the attacker cannot read data or disrupt availability - impact is limited to unauthorized message sending (I:L, C:N, A:N). Affected versions span Spring Framework 5.3.0-5.3.45, 6.0.x-6.0.29, 6.1.0-6.1.23, and 6.2.0-6.2.11; upgrading to a fixed version (6.2.12 OSS, or commercial 6.1.24/5.3.46) removes the condition.

This is a moderate-severity CSRF-class issue (CWE-352) with a vendor CVSS of 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reported by VMware/Spring. The signals are internally consistent and point to LOW real-world priority rather than an urgent threat: network vector and low complexity are offset by the requirement for user interaction (UI:R), no privilege requirement but only limited integrity impact (I:L) and zero confidentiality/availability impact. EPSS is low at 0.31% (22nd percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The impact is narrow - an attacker can cause unauthorized STOMP messages to be sent, not read data or crash the service. No signals conflict: low CVSS, low EPSS, no KEV, and no POC all align. The main caveat is exposure scope - this affects only applications that actually use STOMP over WebSocket, a specific Spring messaging feature, so blanket risk across all Spring deployments is overstated; risk is concentrated in that subset.

A user authenticated to a vulnerable Spring application that exposes STOMP over WebSocket is lured to an attacker-controlled web page. That page uses the victim's browser and existing session to open or reuse a WebSocket/STOMP connection and send unauthorized STOMP messages that bypass the intended security checks, performing actions as the victim. No public exploit code is referenced, and success depends on the victim interacting with attacker content (UI:R).