Spring Framework Authorization Vulnerability Affecting Application Security

CVE-2025-41249

What is CVE-2025-41249?

The Spring Framework's annotation detection mechanism may fail to properly resolve annotations on methods in type hierarchies with parameterized super types featuring unbounded generics. This could pose a risk in scenarios where such annotations are integral to authorization decisions. Applications leveraging Spring Security's @EnableMethodSecurity feature might be particularly vulnerable, especially if security annotations are applied to methods in generic superclasses or interfaces. Those not using @EnableMethodSecurity or security annotations in the indicated contexts are not affected.

References