CVE-2025-41254: Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages

October 16, 2025 (updated October 17, 2025)

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.

References

github.com/advisories/GHSA-7fch-4f2f-jcgm
github.com/spring-projects/spring-framework
nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N&version=3.1
nvd.nist.gov/vuln/detail/CVE-2025-41254
spring.io/security/cve/2025-41254

Code Behaviors & Features

Detect and mitigate CVE-2025-41254 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →