CVE-2025-22223: Medium severity maven/org.springframework.security:spring-security-core vulnerability
Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass.
You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or methods, or all method security annotations are attached to target methods
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.springframework.security:spring-security-coreto a version that resolves this vulnerability.Fixed in 6.4.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22223?
CVE-2025-22223 has a high severity due to the potential for authorization bypass.
How do I fix CVE-2025-22223?
To fix CVE-2025-22223, upgrade Spring Security to version 6.4.4 or later.
Which versions of Spring Security are affected by CVE-2025-22223?
Spring Security versions 6.4.0 to 6.4.3 are affected by CVE-2025-22223.
Does CVE-2025-22223 affect applications without @EnableMethodSecurity?
No, applications that do not use @EnableMethodSecurity are not affected by CVE-2025-22223.
What kind of vulnerability is CVE-2025-22223?
CVE-2025-22223 is an authorization bypass vulnerability related to method security annotations.