REDHAT-BUG-2395725: High severity Spring Framework vulnerability
The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.
Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.
You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.
This CVE is published in conjunction with CVE-2025-41248 https://spring.io/security/cve-2025-41248 .
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2395725?
The severity of REDHAT-BUG-2395725 is considered critical due to potential authorization issues.
How do I fix REDHAT-BUG-2395725?
To fix REDHAT-BUG-2395725, upgrade to the latest version of the Spring Framework and Spring Security that addresses this vulnerability.
What products are affected by REDHAT-BUG-2395725?
Affected products include the Spring Framework and Spring Security due to their annotation detection mechanism.
Can REDHAT-BUG-2395725 affect application security?
Yes, REDHAT-BUG-2395725 can affect application security by misinterpreting annotations used for authorization decisions.
What should I do if I cannot upgrade to fix REDHAT-BUG-2395725?
If you cannot upgrade, consider implementing additional security measures and monitoring to mitigate the impact of REDHAT-BUG-2395725.