ROOT-APP-MAVEN-CVE-2025-41254 CVE-2025-41254 in org.springframework:spring-websocket - Patched by Root

Root has patched CVE-2025-41254 in the org.springframework:spring-websocket package for Root:Maven. Multiple fixed versions available...

Spring Framework STOMP CSRF Vulnerability (CVE-2025-41254)

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework:6.2.0 - 6.2.11, 6.1.0 - 6.1.23, 6.0.x - 6.0.29, 5.3.0 - 5.3.45, Older, unsupported versions are also affected...

Security Bulletin: Security vulnerabilities have been found in IBM Library Support for Spring 2.7.29 and 3.2.17 (CVE-2025-41253, CVE-2025-41254)

Summary IBM Library Support for Spring has addressed these vulnerabilities with an update Vulnerability Details CVEID:CVE-2025-41254 DESCRIPTION: STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Product...

CVE-2025-41254 vulnerabilities

Vulnerabilities for packages: thingsboard...

org.apereo.cas:cas-server-core-api (>=5.3.7, <=5.3.16), org.apereo.cas:cas-server-core-api-authentication (>=5.3.7, <=5.3.16) +28 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.21.release)

org.springframework:spring-websocket MAVEN version 4.3.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.apereo.cas:cas-server-core-api =5.3.7, =5.3.7, =5.3.7, =5.3.7, =5.3.7,...

net.apexes.wsonrpc:wsonrpc (0.5.0), org.springframework.integration:spring-integration-websocket (4.1.0.release) potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.1.2.release)

org.springframework:spring-websocket MAVEN version 4.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - net.apexes.wsonrpc:wsonrpc 0.5.0 -...

net.solarnetwork.common:net.solarnetwork.common.web (>=2.2.0, <=2.4.0), org.springframework.boot:spring-boot-starter-websocket (1.5.20.release) +1 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.23.release)

org.springframework:spring-websocket MAVEN version 4.3.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - net.solarnetwork.common:net.solarnetwork.common.web =2.2.0, =2.4.0 -...

org.chtijbug.drools:drools-platform-runtime-servlet (0.5.0), org.chtijbug.drools:loyalty-soap-server (0.5.0) +2 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.0.5.release)

org.springframework:spring-websocket MAVEN version 4.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.chtijbug.drools:drools-platform-runtime-servlet 0.5.0 -...

com.consol.citrus:citrus-websocket (>=2.5, <=2.6), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=0.0.4, <=0.0.5) +11 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.2.3.release)

org.springframework:spring-websocket MAVEN version 4.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.consol.citrus:citrus-websocket =2.5, =0.0.4, =0.0.4, =0.1.3, =0.1.5, =6.2.1...

ai.driftkit:driftkit-workflow-controllers (>=0.7.5, <=0.9.2), ai.driftkit:driftkit-workflow-engine-spring-boot-starter (>=0.7.0, <=0.9.2) +724 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (>=6.1.0, <=6.1.21)

org.springframework:spring-websocket MAVEN version =6.1.0, =0.7.5, =0.7.0, =0.5.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.1, =1.0.31 and more Source cves: CVE-2025-41254 Source advisory: GHSA-7FCH-4F2F-JCGM...

org.springframework.integration:spring-integration-websocket (4.3.22.release) potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.26.release)

org.springframework:spring-websocket MAVEN version 4.3.26.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.springframework.integration:spring-integration-websocket 4.3.22.release...

org.springframework.boot:spring-boot-starter-websocket (1.5.11.release), org.springframework.integration:spring-integration-websocket (4.3.15.release) potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.15.release)

org.springframework:spring-websocket MAVEN version 4.3.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.springframework.boot:spring-boot-starter-websocket 1.5.11.release -...

com.ahome-it:ahome-tooling-server-core (>=1.1.19-release, <=1.1.26-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.23-release, <=1.1.25-release) +114 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.4.release)

org.springframework:spring-websocket MAVEN version 4.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.19-release, =1.1.23-release,...

com.caucho:spring4-websocket (>=4.0.62, <=4.0.63), net.apexes.wsonrpc:wsonrpc-server-support (>=2.2.0, <=2.8.0) +3 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.25.release)

org.springframework:spring-websocket MAVEN version 4.3.25.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.caucho:spring4-websocket =4.0.62, =2.2.0, =2.8.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +6 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.0.release)

org.springframework:spring-websocket MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

br.com.m4rc310:br-com-m4rc310-gql (1.0.58), br.com.m4rc310:br-com-m4rc310-gtim (1.0.58) +314 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (>=6.0.0, <=6.0.21)

org.springframework:spring-websocket MAVEN version =6.0.0, =3.0.1.0, =3.0.1.0, =1.0.9, =2.0.22, =1.1.5, =0.0.11, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.8.5 and more Source cves: CVE-2025-41254 Source advisory: OSV:GHSA-7FCH-4F2F-JCGM...

com.ahome-it:ahome-tooling-server-core (>=1.0.94-release, <=1.0.108-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.100-release, <=1.0.107-release) +11 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.1.7.release)

org.springframework:spring-websocket MAVEN version 4.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.0.94-release, =1.0.100-release,...

org.ops4j.pax.web.samples:war-vaadin08-spring (>=8.0.1, <=9.0.10) potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.29.release)

org.springframework:spring-websocket MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.ops4j.pax.web.samples:war-vaadin08-spring =8.0.1, =9.0.10 Source cves:...

CVE-2025-41254

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: 6.2.0 - 6.2.11 6.1.0 - 6.1.23 6.0.x - 6.0.29 5.3.0 - 5.3.45 Older, unsupported versions are also affected...

at.aimon.ops:aimon-ops-api (>=0.0.1, <=0.0.2), br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21) +927 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (>=6.2.0, <=6.2.11)

org.springframework:spring-websocket MAVEN version =6.2.0, =0.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2025-41254 Source advisory: MEND:CVE-2025-41254...