CVE-2025-41249: CVE-2025-41249: Spring Framework Annotation Detection Vulnerability
VMware · Spring Framework
Vendor fix available · Affected: VMware Spring Framework · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 41% of scored CVEs
DescriptionCVE.org
The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions. Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction with CVE-2025-41248 https://spring.io/security/cve-2025-41248 .
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- VMware · Spring Frameworkfrom 6.2.x before 6.2.11; from 6.1.x before 6.1.23; from 5.3.x before 5.3.45
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- VMware
- Published
- September 2025
CoverageNo articles yet
No CyberSIXT article names CVE-2025-41249 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.