Spring Patches Two Flaws: SpEL Injection (CVE-2025-41253) Leaks Secrets, STOMP CSRF Bypasses WebSocket Security

VMware Tanzu’s Spring team released fixes for two vulnerabilities affecting Spring Cloud Gateway and the Spring Framework. The first, CVE-2025-41253, arises from misused SpEL in application routes and could allow reading environment variables, system properties, or other sensitive data if an admin or untrusted third party can define routes and actuator endpoints are enabled and unsecured, with the gateway server Webflux affected but not WebMVC.

The second, CVE-2025-41254, relates to STOMP over WebSocket and could permit unauthorized messages by bypassing CSRF protections, threatening real-time applications such as live chats or dashboards.

The advisory states affected Spring Cloud Gateway versions range from 4.0.0 to 4.3.0 (and 4.3.x, 4.2.x, 4.1.x, 4.0.x, 3.1.x), while Spring Framework STOMP over WebSocket vulnerabilities affect 6.2.0–6.2.11, 6.1.0–6.1.23, 6.0.x–6.0.29 and 5.3.0–5.3.45, with patches available in 4.3.2, 4.2.6, 4.1.12 and 3.1.12 for Gateway, and 6.2.12, 6.1.24, and 5.3.46 for the Framework.

According to the Spring team, users unable to upgrade should remove gateway from the management.endpoints.web.exposure[.]include property or secure the actuator endpoints to prevent remote SpEL execution; for the STOMP flaw, patches exist but older releases remain vulnerable.