Read the docs
TI-2025-27495 Aliases CVE-2025-41249GHSA-jmp9-x22r-554x

CVE-2025-41249: Spring Framework Annotation Detection Vulnerability

Priority LOW 33CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 3 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-285.

Summary

The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions. Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction with CVE-2025-41248 https://spring.io/security/cve-2025-41248 .

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00478 41st percentileScored 2026-11-07
Fix Partial Spring Framework (VMware): 6.2.11, 6.1.23, 5.3.45org.springframework:spring-core (Maven): 6.2.11Red Hat: 3 advisoriesRed Hat: 3 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring Framework6.2.x to before 6.2.11; 6.1.x to before 6.1.23; 5.3.x to before 5.3.456.2.11, 6.1.23, 5.3.45Patch availableCNA
—org.springframework:spring-core (Maven)5.3.0 – 5.3.44—No fix listedGHSA-jmp9-x22r-554x
—org.springframework:spring-core (Maven)6.0.0 – 6.1.22—No fix listedGHSA-jmp9-x22r-554x
—org.springframework:spring-core (Maven)6.2.0 to before 6.2.116.2.11Patch availableGHSA-jmp9-x22r-554x
  • Spring Framework VendorVMware Affected 6.2.x to before 6.2.11; 6.1.x to before 6.1.23; 5.3.x to before 5.3.45 Fixed in 6.2.11, 6.1.23, 5.3.45 Patch available CNA
  • org.springframework:spring-core (Maven) Vendor— Affected 5.3.0 – 5.3.44 Fixed in — No fix listed GHSA-jmp9-x22r-554x
  • org.springframework:spring-core (Maven) Vendor— Affected 6.0.0 – 6.1.22 Fixed in — No fix listed GHSA-jmp9-x22r-554x
  • org.springframework:spring-core (Maven) Vendor— Affected 6.2.0 to before 6.2.11 Fixed in 6.2.11 Patch available GHSA-jmp9-x22r-554x

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*——VMware
  • cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions — — ·VMware

Remediation

  • Fix · CNA Spring Framework (VMware) Fixed in 6.2.11, 6.1.23, 5.3.45
  • Fix · GHSA-jmp9-x22r-554x org.springframework:spring-core (Maven) Fixed in 6.2.11 Advisory →

Red Hat 3 advisories

  • RHSA-2025:22765 Released 2025-12-04 · Red Hat rating Important
    HawtIO 4.3.0 for Red Hat build of Apache Camel 4 Release and security update.
    • HawtIO HawtIO 4.3.0
  • RHSA-2025:19094 Released 2025-10-23 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.24.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +4
  • RHSA-2025:18028 Released 2025-10-14 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.10.7 for Spring Boot release.
    • Red Hat build of Apache Camel 4.10.7 for Spring Boot 3.4.10

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix planned: Will not fix
Red Hat AMQ ClientsAffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix yet
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
HawtIO HawtIO 4.3.0Fixed RHSA-2025:22765
Red Hat OpenShift Dev Spaces (RHOSDS) 3.24Fixed RHSA-2025:19094
Red Hat build of Apache Camel 4.10.7 for Spring Boot 3.4.10Fixed RHSA-2025:18028
Not affected: 9 products
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.24
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-41249
  2. 2026-10-03 Alias added: GHSA-jmp9-x22r-554x

References

Advisory 1

Other 5

  • TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8
See all 1181 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences