Spring Framework and Spring Security Vulnerabilities Expose Authorization Bypass Risks (CVE-2025-41248 & CVE-2025-41249)

According to the advisory, two related vulnerabilities—CVE-2025-41248 and CVE-2025-41249—affect Spring Security and the Spring Framework, arising from annotation resolution flaws in method security checks when parameterised types with unbounded generics are involved. The issues, rated CVSS 4.4 (Medium), pose risks for applications using method-level security annotations such as @PreAuthorize, particularly those enabling @EnableMethodSecurity.

CVE-2025-41248 affects Spring Security versions 6.4.0–6.4.9 and 6.5.0–6.5.3, with fixes in Spring Security 6.4.10 and 6.5.4 (OSS); CVE-2025-41249 affects Spring Framework versions 6.2.0–6.2.10, 6.1.0–6.1.22 and 5.3.0–5.3.44, with fixes in Spring Framework 6.2.11 (OSS), 6.1.23 (Commercial) and 5.3.45 (Commercial).

Mitigation and recommendations urge upgrading to the patched versions, and the advisory notes that if upgrades are not immediately possible, you can ensure all secured target methods are declared in their target class.