Spring Security and Spring Framework Release Fixes for CVE-2025-41248 and CVE-2025-41249
The Spring Security and Spring Framework teams have collaborated to release fixes for the following CVEs.
- CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types
- CVE-2025-41249: Spring Framework Annotation Detection Vulnerability
Both of these CVE reports pertain to vulnerabilities that may be encountered when using security annotations on methods within type hierarchies with a parameterized super type with unbounded generics. See the individual CVE reports for further details.
CVE-2025-41248
The Spring Security 6.4.11 and 6.5.5 open source releases address CVE-2025-41248…