Skip to content
OpenAdvisories

Package · Maven

org.springframework:spring-websocket

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-41838

    Spring Framework Predictable Session ID in WebSocket Module

    IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.…

    Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  • Medium 4.3
    CVE-2025-41254

    Spring Framework STOMP CSRF Vulnerability

    STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: * 6.2.0 - 6.2.11 * 6.1.0 - 6.1.23 * 6.0.x - 6.0.29 * 5.3.0 - 5.3.45 * Older,…

    VMware Spring Framework libspring-java libspring-java Debian Ubuntu Maven