{"schemaVersion":3,"id":"CVE-2025-41248","aliases":["CGA-26m2-784x-3h3r","CGA-28p4-2rrh-6729","CGA-2q3c-9vrf-fxx9","CGA-3955-q4pc-wj78","CGA-4492-fwfm-frw8","CGA-49fv-5r39-mqfq","CGA-5c8m-qpp5-wq7f","CGA-5qvc-63h5-cfxc","CGA-84qw-345v-89j9","CGA-88mg-jq4q-27gc","CGA-8gp8-7pw2-vq54","CGA-8p4p-q5v9-j9xh","CGA-9hjh-96f4-8xf7","CGA-9q9m-mvhh-4239","CGA-c3gx-6537-mggr","CGA-f8w4-7ccc-xm8x","CGA-fgv2-qh36-3jrm","CGA-gwwv-mfqc-5522","CGA-hf45-cr87-pv56","CGA-hxv8-j5f3-r9mg","CGA-jm9c-gm38-f6v6","CGA-jxr8-9r69-vj5v","CGA-p473-c5w9-7527","CGA-pcrq-6mm8-hmrr","CGA-pj2p-3fjf-fxq8","CGA-qfvc-886x-84g5","CGA-qg5p-6qxp-q63h","CGA-r2w4-q3rw-rv7m","CGA-r59m-xf29-mrm6","CGA-v45p-57c5-jjjr","CGA-vmqh-5cvp-49wp","CGA-w384-9r5g-2rjg","CGA-x33x-jm5q-ww8x","CGA-x5mx-jwwq-hggx","CGA-2g66-25g8-xhq4","CGA-33xw-r8j7-qmgf","CGA-38mc-mcq9-j9mw","CGA-446j-w33f-9h7c","CGA-4f98-h9f6-fcqh","CGA-5rrq-4v7v-26ph","CGA-9h8v-9f24-w96p","CGA-f8mq-g355-jjph","CGA-h32c-r4m7-j5x8","CGA-jh33-c5v5-7ccq","CGA-pg47-2x8p-7p9r","CGA-ppj8-cp65-gp5f","GHSA-8v5q-rhf3-jphm","CGA-qhr5-3wwh-pcqr","CGA-wq89-7m83-cwwj"],"status":"published","duplicateOf":null,"title":null,"description":"The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass.\n\nYour application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.\n\nYou are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.\n\nThis CVE is published in conjunction with  CVE-2025-41249 https://spring.io/security/cve-2025-41249 .","dates":{"published":"2025-09-16T10:10:59.953Z","modified":"2025-09-18T06:29:51.189Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00434,"percentile":0.36261,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.00434},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00434,"percentile":0.36261}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00434,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00434,"percentile":0.36261}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-289","name":"Authentication Bypass by Alternate Name","description":"The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/289.html"}],"affected":[{"vendor":"chainguard","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi","purlType":"apk","versions":[{"text":"< 2.5.0-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.0-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-compat","name":"apache-nifi-compat","label":"apache-nifi-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-compat","purlType":"apk","versions":[{"text":"< 2.5.0-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.0-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-registry","name":"apache-nifi-registry","label":"apache-nifi-registry","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-registry","purlType":"apk","versions":[{"text":"< 2.5.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.0-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-registry-toolkit","name":"apache-nifi-registry-toolkit","label":"apache-nifi-registry-toolkit","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-registry-toolkit","purlType":"apk","versions":[{"text":"< 2.5.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.0-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-toolkit","name":"apache-nifi-toolkit","label":"apache-nifi-toolkit","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-toolkit","purlType":"apk","versions":[{"text":"< 2.5.0-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.0-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2","name":"jenkins-2","label":"jenkins-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2-openjdk-17","name":"jenkins-2-openjdk-17","label":"jenkins-2-openjdk-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2-openjdk-17","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2-openjdk-21","name":"jenkins-2-openjdk-21","label":"jenkins-2-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2-openjdk-21","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.504-openjdk-17","name":"jenkins-2.504-openjdk-17","label":"jenkins-2.504-openjdk-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.504-openjdk-17","purlType":"apk","versions":[{"text":"< 2.504.3-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.504.3-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.504-openjdk-21","name":"jenkins-2.504-openjdk-21","label":"jenkins-2.504-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.504-openjdk-21","purlType":"apk","versions":[{"text":"< 2.504.3-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.504.3-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.516-openjdk-17","name":"jenkins-2.516-openjdk-17","label":"jenkins-2.516-openjdk-17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.516-openjdk-17","purlType":"apk","versions":[{"text":"< 2.516.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.516.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-2.516-openjdk-21","name":"jenkins-2.516-openjdk-21","label":"jenkins-2.516-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-2.516-openjdk-21","purlType":"apk","versions":[{"text":"< 2.516.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.516.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-compat","name":"jenkins-compat","label":"jenkins-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-compat","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-docker-agent-openjdk-21","name":"jenkins-docker-agent-openjdk-21","label":"jenkins-docker-agent-openjdk-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-docker-agent-openjdk-21","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-remoting","name":"jenkins-remoting","label":"jenkins-remoting","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-remoting","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jenkins-utils","name":"jenkins-utils","label":"jenkins-utils","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jenkins-utils","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nacos","name":"nacos","label":"nacos","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos","purlType":"apk","versions":[{"text":"< 3.1.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.1.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nacos-compat","name":"nacos-compat","label":"nacos-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos-compat","purlType":"apk","versions":[{"text":"< 3.1.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.1.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nacos-docker","name":"nacos-docker","label":"nacos-docker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos-docker","purlType":"apk","versions":[{"text":"< 3.1.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.1.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard","name":"thingsboard","label":"thingsboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard","purlType":"apk","versions":[{"text":"< 4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-js-executor","name":"thingsboard-tb-js-executor","label":"thingsboard-tb-js-executor","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-js-executor","purlType":"apk","versions":[{"text":"< 4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-mqtt-transport","name":"thingsboard-tb-mqtt-transport","label":"thingsboard-tb-mqtt-transport","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-mqtt-transport","purlType":"apk","versions":[{"text":"< 4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-web-ui","name":"thingsboard-tb-web-ui","label":"thingsboard-tb-web-ui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-web-ui","purlType":"apk","versions":[{"text":"< 4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi","purlType":"apk","versions":[{"text":"< 2.5.0-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.0-r11","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-compat","name":"apache-nifi-compat","label":"apache-nifi-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-compat","purlType":"apk","versions":[{"text":"< 2.5.0-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.0-r11","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-registry","name":"apache-nifi-registry","label":"apache-nifi-registry","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-registry","purlType":"apk","versions":[{"text":"< 2.5.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.0-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-registry-toolkit","name":"apache-nifi-registry-toolkit","label":"apache-nifi-registry-toolkit","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-registry-toolkit","purlType":"apk","versions":[{"text":"< 2.5.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.0-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-toolkit","name":"apache-nifi-toolkit","label":"apache-nifi-toolkit","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-toolkit","purlType":"apk","versions":[{"text":"< 2.5.0-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.0-r11","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-2","name":"jenkins-2","label":"jenkins-2","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-2","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-2-openjdk-17","name":"jenkins-2-openjdk-17","label":"jenkins-2-openjdk-17","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-2-openjdk-17","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-2-openjdk-21","name":"jenkins-2-openjdk-21","label":"jenkins-2-openjdk-21","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-2-openjdk-21","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-compat","name":"jenkins-compat","label":"jenkins-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-compat","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-docker-agent-openjdk-21","name":"jenkins-docker-agent-openjdk-21","label":"jenkins-docker-agent-openjdk-21","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-docker-agent-openjdk-21","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-remoting","name":"jenkins-remoting","label":"jenkins-remoting","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-remoting","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jenkins-utils","name":"jenkins-utils","label":"jenkins-utils","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jenkins-utils","purlType":"apk","versions":[{"text":"< 2.528-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.528-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard","name":"thingsboard","label":"thingsboard","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard","purlType":"apk","versions":[{"text":"< 4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-js-executor","name":"thingsboard-tb-js-executor","label":"thingsboard-tb-js-executor","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-js-executor","purlType":"apk","versions":[{"text":"< 4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-mqtt-transport","name":"thingsboard-tb-mqtt-transport","label":"thingsboard-tb-mqtt-transport","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-mqtt-transport","purlType":"apk","versions":[{"text":"< 4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-web-ui","name":"thingsboard-tb-web-ui","label":"thingsboard-tb-web-ui","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-web-ui","purlType":"apk","versions":[{"text":"< 4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2-r6","eol":null,"hubHref":null},{"vendor":"org.springframework.security","product":"spring-security-core","name":"org.springframework.security:spring-security-core","label":"spring-security-core","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.springframework.security/spring-security-core","purlType":"maven","versions":[{"text":"≥ 6.4.0, < 6.4.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.0, < 6.5.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.4.0, < 6.4.10 | ≥ 6.5.0, < 6.5.4","eol":{"isEol":null,"eolDate":null,"matchMethod":"purl","cycle":null,"product":{"name":"spring-security","label":"Spring Security","category":"framework"}},"hubHref":null},{"vendor":"vmware","product":"spring_security","name":"spring security","label":"spring_security","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 6.4.x, < 6.4.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.x, < 6.5.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.4.x, < 6.4.11 | ≥ 6.5.x, < 6.5.5","eol":null,"hubHref":"/vendor/vmware/spring_security"}],"affectedCount":43,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://spring.io/security/cve-2025-41248","label":"spring.io/security/cve-2025-41248","hostname":"spring.io","tags":["WEB"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-41248","label":"nvd.nist.gov/vuln/detail/CVE-2025-41248","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/spring-projects/spring-security/issues/17898","label":"github.com/spring-projects/spring-security/issues/17898","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/spring-projects/spring-security/issues/17899","label":"github.com/spring-projects/spring-security/issues/17899","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/spring-projects/spring-security/commit/d0f93fa6d8338149943ae640c53db07de827867f","label":"github.com/spring-projects/spring-security/commit/d0f93fa6d8338149943ae640c53db07de827867f","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/spring-projects/spring-security/commit/e5694ac7b5e4394b920c6cab48b7bfbd871f84bd","label":"github.com/spring-projects/spring-security/commit/e5694ac7b5e4394b920c6cab48b7bfbd871f84bd","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/spring-projects/spring-security","label":"github.com/spring-projects/spring-security","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/spring-projects/spring-security/releases/tag/6.4.10","label":"github.com/spring-projects/spring-security/releases/tag/6.4.10","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/spring-projects/spring-security/releases/tag/6.5.4","label":"github.com/spring-projects/spring-security/releases/tag/6.5.4","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-45WG-C69F-9PXW","CGA-47JF-XQVQ-3FR9","CGA-54H6-37V4-CX92","CGA-96M7-MFVW-47GJ","CGA-H9JQ-V2GM-6PVR","CGA-HW96-M9RM-4VWV","CGA-RJG8-XX85-C2F9","CGA-RWGR-CP2M-G7JV"]},"timeline":[{"kind":"published","date":"2025-09-16T10:10:59.953Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-09-18T06:29:51.189Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T12:11:51.976Z","stale":false,"partial":false}}