CVE-2025-41254

What it actually does

The flaw permits unauthorized STOMP messages to be sent over WebSocket connections by bypassing intended authorization checks in the Spring Framework message handling layer.

Why it matters to the business

Attackers can inject or manipulate messages in WebSocket-based STOMP applications, potentially disrupting service operations or altering application state without proper access controls.

How an attack unfolds

An attacker establishes a WebSocket connection to a vulnerable STOMP endpoint and sends crafted STOMP frames that evade authorization validation, allowing delivery of messages that should have been blocked.

How to fix it

Upgrade Spring Framework to 6.2.12, 6.1.24, or 5.3.46 depending on the branch in use; unsupported versions require migration or custom mitigation.

How to confirm the fix worked

Verify the deployed Spring Framework version against the fixed releases and test STOMP message flows with authorization rules enabled to confirm bypass attempts are now rejected.

Typical attack path

1. Identify a Spring-based application exposing STOMP over WebSocket endpoints
2. Establish an unauthenticated or low-privilege WebSocket connection
3. Craft and transmit STOMP messages that bypass authorization logic
4. Observe successful delivery of unauthorized messages to backend handlers

How to detect it

Inspect application logs for STOMP frame processing events that occur outside expected authorization contexts and review WebSocket connection metadata for anomalous message origins.

What your security team should do

• Prioritize upgrade of all Spring Framework instances to the corresponding fixed versions
• Review and strengthen authorization configuration on STOMP endpoints
• Monitor for unusual message patterns on WebSocket connections