Description
The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass.
Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.
You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.
This CVE is published in conjunction with CVE-2025-41249 https://spring.io/security/cve-2025-41249 .
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VMware | Spring Security | 6.4.x – < 6.4.11, 6.5.x – < 6.5.5 | 6.4.11 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apache-nifi +2 | 2.5.0-r11 | — |
| Wolfi rolling | apache-nifi-registry +1 | 2.5.0-r6 | — |
| Wolfi rolling | jenkins-2 +6 | 2.528-r0 | — |
| Wolfi rolling | thingsboard +4 | 4.2-r6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | >= 6.4.0, < 6.4.10 | 6.4.10 | GHSA-8v5q-rhf3-jphm |
| Maven | org.springframework.security:spring-security-core | >= 6.5.0, < 6.5.4 | 6.5.4 | GHSA-8v5q-rhf3-jphm |
Advisories 12
- WID-SEC-2025-2060 VMware Tanzu Spring Framework und Spring Security: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 25, 2026
- WID-SEC-2026-0351 Dell NetWorker (Third Party Components): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- WID-SEC-2026-0162 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 24, 2026
- NCSC-2026-0258 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jul 22, 2026
- WID-SEC-2026-2445 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2026-1204 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-0559 IBM Rational Build Forge: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 1, 2026
- NCSC-2026-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0025 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0163 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- NCSC-2025-0293 Kwetsbaarheden verholpen in Spring Framework NCSC-NL (Netherlands) · Sep 16, 2025