CVE-2025-41248

🗓️ 16 Sep 2025 10:10:59Reported by vmwareType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 50 Views

Spring Security may misresolve method annotations in generic hierarchies when EnableMethodSecurity is used, risking bypass.

Reporter	Title	Published	Views	Family All 78
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for December 2025 - Multiple CVEs addressed	29 Jan 202607:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by a vulnerability in spring-security-core-6.4.3.jar (CVE-2025-41248)	7 Oct 202507:19	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerability in Spring Security Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-41248)	12 Jun 202618:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Improper Authorization in Spring Framework [CVE-2025-41249]	17 Dec 202514:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in spring-security-core (CVE-2025-41248)	10 Mar 202610:14	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.1.0	5 Dec 202509:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway	12 Jun 202618:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	9 Dec 202515:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability has addressed Multiple Vulnerabilities within Instana Agent container image	3 Mar 202613:53	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring Framework affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Jun 202613:41	–	ibm

[
  {
    "defaultStatus": "unaffected",
    "product": "Spring Security",
    "vendor": "VMware",
    "versions": [
      {
        "lessThan": "6.4.11",
        "status": "affected",
        "version": "6.4.x",
        "versionType": "OSS"
      },
      {
        "lessThan": "6.5.5",
        "status": "affected",
        "version": "6.5.x",
        "versionType": "OSS"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2025-41248

17 Jun 2026 09:22Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.5

EPSS0.00433

SSVC

CWE-289