CVE-2025-41234

🗓️ 12 Jun 2025 21:14:42Reported by vmwareType

Spring Framework versions 6.x vulnerable to RFD attack via 'Content-Disposition' header with user input.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a reflected file download (RFD) attack in Spring Framework [CVE-2025-41234]	28 Aug 202517:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by a vulnerability in spring-web-6.2.3.jar(CVE-2025-41234)	7 Oct 202506:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in the Spring framework (CVE-2025-41234)	29 Sep 202523:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager	16 Dec 202507:00	–	ibm
IBM Security Bulletins	Security Bulletin: Reflected File Download (RFD) Vulnerability in Spring Framework Content-Disposition Header Handling (CWE-113), which affects IBM watsonx.data	27 Oct 202513:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to an issue in Spring Framework	26 Aug 202517:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses an application is vulnerable to a reflected file download (RFD) attack.	9 Jul 202507:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	25 Sep 202516:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager	16 Dec 202505:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	31 Oct 202519:08	–	ibm

[
  {
    "defaultStatus": "unaffected",
    "product": "Spring Framework",
    "vendor": "VMware",
    "versions": [
      {
        "changes": [
          {
            "at": "6.0.29",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.0.28",
        "status": "affected",
        "version": "6.0.5",
        "versionType": "COMMERCIAL"
      },
      {
        "changes": [
          {
            "at": "6.1.21",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.1.20",
        "status": "affected",
        "version": "6.1.0",
        "versionType": "OSS"
      },
      {
        "changes": [
          {
            "at": "6.2.8",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.2.7",
        "status": "affected",
        "version": "6.2.0",
        "versionType": "OSS"
      }
    ]
  }
]

Source	Link
nvd	www.nvd.nist.gov/vuln-metrics/cvss/v3-calculator
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-41234
spring	www.spring.io/security/cve-2025-41234

15 Apr 2026 00:35Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.16.5

EPSS0.00294

SSVC

CWE-113