{"cve":"CVE-2025-41249","nvd":{"published":"2025-09-16T11:15:30.887","modified":"2026-06-17T09:22:40.307","status":"Deferred","description":"The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.\n\nYour application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.\n\nYou are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.\n\nThis CVE is published in conjunction with  CVE-2025-41248 https://spring.io/security/cve-2025-41248 .","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-285"],"references":["https://spring.io/security/cve-2025-41249"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:08:41.295252406+00:00"},"epss":{"cve":"CVE-2025-41249","score":0.00478,"percentile":0.41271,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-jmp9-x22r-554x","url":"https://osv.dev/vulnerability/GHSA-jmp9-x22r-554x","summary":"Spring Framework annotation detection mechanism may result in improper authorization","modified":"2026-09-10T03:50:28.526913629Z","packages":[{"ecosystem":"Maven","name":"org.springframework:spring-core","purl":"pkg:maven/org.springframework/spring-core","ranges":[">=5.3.0 <=5.3.44"],"fixed":[]},{"ecosystem":"Maven","name":"org.springframework:spring-core","purl":"pkg:maven/org.springframework/spring-core","ranges":[">=6.0.0 <=6.1.22"],"fixed":[]},{"ecosystem":"Maven","name":"org.springframework:spring-core","purl":"pkg:maven/org.springframework/spring-core","ranges":[">=6.2.0 <6.2.11"],"fixed":["6.2.11"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}