CVE-2025-41249— CVE-2025-41249: Spring Framework Annotation Detection Vulnerability
Quick assessment
Affected
VMware Spring Framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Spring Framework是Spring开源的一款应用开发框架。 Spring Framework存在安全漏洞，该漏洞源于注解检测机制无法正确解析泛型超类中的方法注解，可能导致授权决策错误。
Possible ATT&CK Techniques 1 AI
T1552.003 · Shell History
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-41249
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CVE-2025-41249: Spring Framework Annotation Detection Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.
Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.
You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.
This CVE is published in conjunction with CVE-2025-41248 https://spring.io/security/cve-2025-41248 .
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Spring Framework 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Spring Framework是Spring开源的一款应用开发框架。 Spring Framework存在安全漏洞，该漏洞源于注解检测机制无法正确解析泛型超类中的方法注解，可能导致授权决策错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| VMware | Spring Framework | 6.2.x ~ 6.2.11 | - |
|
II. Public POCs for CVE-2025-41249
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-41249
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-41249 (1)
IV. Related Vulnerabilities
Same product: Spring Framework
-
CVE-2026-59314
Spring Framework response splitting in ContentDisposition -
CVE-2026-59313
Server Sent Event stream corruption in Spring MVC functional -
CVE-2026-59283
Spring Framework Safety Guard Bypass via SpEL Expression Com -
CVE-2026-59282
Spring Framework Denial of Service via Unbounded List Growth -
CVE-2026-59281
Spring Framework Cross-site Scripting via EscapedErrors
Same vendor: VMware
-
CVE-2026-59347
VMware Workstation and Fusion HGFS stack-based buffer-overfl -
CVE-2026-59346
VMware Workstation and Fusion VMXNET3 integer-overflow vulne -
CVE-2026-59355
Spring Authorization Server: Open Redirect via request_uri p -
CVE-2026-41709
ESX insufficient logging vulnerability -
CVE-2026-41703
Out-of-bounds read vulnerability
V. Comments for CVE-2025-41249
No comments yet