Skip to content

Product

org.springframework/spring-websocket vulnerabilities

2 published CVES affecting org.springframework/spring-websocket, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest org.springframework/spring-websocket CVEs

Newest publication first

  1. CVE-2026-41838 Spring Framework Predictable Session ID in WebSocket Module

    Published
    MediumCVSS 4.8 EPSS 0.17%

    IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1...

  2. CVE-2025-41254 Spring Framework STOMP CSRF Vulnerability

    Published
    MediumCVSS 4.3

    STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: 6.2.0 - 6.2.11 6.1.0 - 6.1.23 6.0.x - 6.0.29 5.3.0 - 5.3.45 Older, unsupported versions are also...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.