---
id: CVE-2025-41254
title: >-
  STOMP over WebSocket applications may be vulnerable to a security bypass that
  allows an attacker to send unauthorized messages.


  Affected Spring Products and VersionsSpring Framework:

    *  6.2.0 - 6.2.11
    *  6.1.0 - 6.1.23
    *  6.0.x -…
summary: >-
  STOMP over WebSocket applications may be vulnerable to a security bypass that
  allows an attacker to send unauthorized messages.


  Affected Spring Products and VersionsSpring Framework:

    *  6.2.0 - 6.2.11
    *  6.1.0 - 6.1.23
    *  6.0.x -…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-352
published: '2025-10-16'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T10:10:00.193'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-41254'
references:
  - url: >-
      https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N&version=3.1
    label: security@vmware.com
  - url: 'https://spring.io/security/cve/2025-41254'
    label: security@vmware.com
tags:
  - nvd
epss: 0.00314
epssPercentile: 0.22282
ingestedAt: '2026-10-09T12:53:28.985Z'
---

## Overview

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.

Affected Spring Products and VersionsSpring Framework:

  *  6.2.0 - 6.2.11
  *  6.1.0 - 6.1.23
  *  6.0.x - 6.0.29
  *  5.3.0 - 5.3.45
  *  Older, unsupported versions are also affected.


MitigationUsers of affected versions should upgrade to the corresponding fixed version.

Affected version(s)Fix versionAvailability6.2.x6.2.12OSS6.1.x6.1.24 Commercial https://enterprise.spring.io/ 6.0.xN/A Out of support https://spring.io/projects/spring-framework#support 5.3.x5.3.46 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary.

CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.