This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Spring STOMP and Cloud Gateway Server Webflux fix 2 vulnerabilities

Spring is fixing 2 vulnerabilities in 2 products [1][2]. Individual products and their fixed versions: Spring STOMP - 6.2.12, 6.1.24, 5.3.46 [1] Spring Cloud Gateway Server Webflux - 4.3.2, 4.2.6, 4.1.12, 3.1.12 [2]

Spring STOMP - CSRF (CVE-2025-41254)
CVSS 4.3 (Medium)

An unauthenticated remote attacker can carry out a CSRF attack and thus send messages without authorization [1].

The vulnerability is present in product:

  • Spring STOMP; >=5.3, <5.3.46; >=6.0, <6.1.24, >=6.2, <6.2.12;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

More information:

The vulnerability was publicly disclosed 16. 10. 2025.

Spring Cloud Gateway Server Webflux - sensitive information leak (CVE-2025-41253)
CVSS 7.5 (High)

An unauthenticated remote attacker can access environment variables and other sensitive information from the system. The vulnerability is exploitable only if the attacker can use Spring Expression Language (SpEL) to craft a path for accessing environment variables and system properties, and also has access to an unsecured web endpoint. Details on the exploitation limitations can be found at [2].

The vulnerability is present in product:

  • Spring Cloud Gateway Server Webflux; >=3.1, <3.1.12; >=4.0, <4.1.12; >=4.2, <4.2.6; >=4.3, <4.3.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

  • CVE-2025-41253 at cve.org, NVD
  • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 16. 10. 2025.

By CESNET, z.s.p.o. Martin Krajči on 20. 10. 2025.

CESNET, z.s.p.o. Logo