Vulnerability-Lookup

ubuntu-cve-2025-41234

Vulnerability from osv_ubuntu

Published

2025-06-12 22:15

Modified

2026-05-20 15:22

Summary

Details

Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input. Specifically, an application is vulnerable when all the following are true: * The header is prepared with org.springframework.http.ContentDisposition. * The filename is set via ContentDisposition.Builder#filename(String, Charset). * The value for the filename is derived from user-supplied input. * The application does not sanitize the user-supplied input. * The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details). An application is not vulnerable if any of the following is true: * The application does not set a “Content-Disposition” response header. * The header is not prepared with org.springframework.http.ContentDisposition. * The filename is set via one of: * ContentDisposition.Builder#filename(String), or * ContentDisposition.Builder#filename(String, ASCII) * The filename is not derived from user-supplied input. * The filename is derived from user-supplied input but sanitized by the application. * The attacker cannot inject malicious content in the downloaded content of the response. Affected Spring Products and VersionsSpring Framework: * 6.2.0 - 6.2.7 * 6.1.0 - 6.1.20 * 6.0.5 - 6.0.28 * Older, unsupported versions are not affected MitigationUsers of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix versionAvailability6.2.x6.2.8OSS6.1.x6.1.21OSS6.0.x6.0.29 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. CWE-113 in Content-Disposition handling in VMware Spring Framework versions 6.0.5 to 6.2.7 allows remote attackers to launch Reflected File Download (RFD) attacks via unsanitized user input in ContentDisposition.Builder#filename(String, Charset) with non-ASCII charsets.

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-41234	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-41234	REPORT
	https://spring.io/security/cve-2025-41234	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspring-aop-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-beans-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-context-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-context-support-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-core-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-expression-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-instrument-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-jdbc-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-jms-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-orm-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-oxm-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-test-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-transaction-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-web-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-web-portlet-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-web-servlet-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          },
          {
            "binary_name": "libspring-web-struts-java",
            "binary_version": "3.0.6.RELEASE-13ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "libspring-java",
        "purl": "pkg:deb/ubuntu/libspring-java@3.0.6.RELEASE-13ubuntu0.1~esm2?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.6.RELEASE-7",
        "3.0.6.RELEASE-8",
        "3.0.6.RELEASE-9",
        "3.0.6.RELEASE-10",
        "3.0.6.RELEASE-11",
        "3.0.6.RELEASE-12",
        "3.0.6.RELEASE-13",
        "3.0.6.RELEASE-13ubuntu0.1~esm1",
        "3.0.6.RELEASE-13ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspring-aop-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-beans-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-context-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-context-support-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-core-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-expression-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-instrument-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-jdbc-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-jms-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-orm-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-oxm-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-test-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-transaction-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-web-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-web-portlet-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-web-servlet-java",
            "binary_version": "3.2.13-5ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "libspring-java",
        "purl": "pkg:deb/ubuntu/libspring-java@3.2.13-5ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.2.13-3",
        "3.2.13-4",
        "3.2.13-5",
        "3.2.13-5ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspring-aop-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-beans-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-context-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-context-support-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-core-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-expression-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-instrument-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-jdbc-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-jms-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-messaging-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-orm-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-oxm-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-test-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-transaction-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-web-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-web-portlet-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          },
          {
            "binary_name": "libspring-web-servlet-java",
            "binary_version": "4.3.22-1~18.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "libspring-java",
        "purl": "pkg:deb/ubuntu/libspring-java@4.3.22-1~18.04.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.3.11-1",
        "4.3.12-1",
        "4.3.13-2",
        "4.3.14-1",
        "4.3.22-1~18.04",
        "4.3.22-1~18.04.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspring-aop-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-beans-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-context-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-context-support-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-core-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-expression-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-instrument-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-jdbc-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-jms-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-messaging-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-orm-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-oxm-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-test-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-transaction-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-web-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-web-portlet-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-web-servlet-java",
            "binary_version": "4.3.22-4ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "libspring-java",
        "purl": "pkg:deb/ubuntu/libspring-java@4.3.22-4ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.3.22-4",
        "4.3.22-4ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspring-aop-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-beans-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-context-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-context-support-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-core-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-expression-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-instrument-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-jdbc-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-jms-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-messaging-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-orm-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-oxm-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-test-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-transaction-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-web-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-web-portlet-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libspring-web-servlet-java",
            "binary_version": "4.3.30-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "libspring-java",
        "purl": "pkg:deb/ubuntu/libspring-java@4.3.30-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.3.30-1",
        "4.3.30-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspring-aop-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-beans-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-context-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-context-support-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-core-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-expression-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-instrument-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-jdbc-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-jms-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-messaging-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-orm-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-oxm-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-test-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-transaction-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-web-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-web-portlet-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libspring-web-servlet-java",
            "binary_version": "4.3.30-2ubuntu0.24.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "libspring-java",
        "purl": "pkg:deb/ubuntu/libspring-java@4.3.30-2ubuntu0.24.04.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.3.30-2",
        "4.3.30-2ubuntu0.24.04.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspring-aop-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-beans-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-context-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-context-support-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-core-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-expression-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-instrument-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-jdbc-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-jms-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-messaging-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-orm-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-oxm-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-test-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-transaction-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-web-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-web-portlet-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-web-servlet-java",
            "binary_version": "4.3.30-3ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "libspring-java",
        "purl": "pkg:deb/ubuntu/libspring-java@4.3.30-3ubuntu1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.3.30-2ubuntu1",
        "4.3.30-3ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspring-aop-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-beans-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-context-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-context-support-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-core-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-expression-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-instrument-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-jdbc-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-jms-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-messaging-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-orm-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-oxm-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-test-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-transaction-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-web-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-web-portlet-java",
            "binary_version": "4.3.30-3ubuntu1"
          },
          {
            "binary_name": "libspring-web-servlet-java",
            "binary_version": "4.3.30-3ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "libspring-java",
        "purl": "pkg:deb/ubuntu/libspring-java@4.3.30-3ubuntu1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.3.30-3ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a \u201cContent-Disposition\u201d header with a non-ASCII charset, where the filename attribute is derived from user-supplied input. Specifically, an application is vulnerable when all the following are true:   *  The header is prepared with org.springframework.http.ContentDisposition.   *  The filename is set via ContentDisposition.Builder#filename(String, Charset).   *  The value for the filename is derived from user-supplied input.   *  The application does not sanitize the user-supplied input.   *  The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details). An application is not vulnerable if any of the following is true:   *  The application does not set a \u201cContent-Disposition\u201d response header.   *  The header is not prepared with org.springframework.http.ContentDisposition.   *  The filename is set via one of:  * ContentDisposition.Builder#filename(String), or   *  ContentDisposition.Builder#filename(String, ASCII)   *  The filename is not derived from user-supplied input.   *  The filename is derived from user-supplied input but sanitized by the application.   *  The attacker cannot inject malicious content in the downloaded content of the response. Affected Spring Products and VersionsSpring Framework:   *  6.2.0 - 6.2.7   *  6.1.0 - 6.1.20   *  6.0.5 - 6.0.28   *  Older, unsupported versions are not affected MitigationUsers of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix versionAvailability6.2.x6.2.8OSS6.1.x6.1.21OSS6.0.x6.0.29 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. CWE-113 in `Content-Disposition` handling in VMware Spring Framework versions 6.0.5 to 6.2.7 allows remote attackers to launch Reflected File Download (RFD) attacks via unsanitized user input in `ContentDisposition.Builder#filename(String, Charset)` with non-ASCII charsets.",
  "id": "UBUNTU-CVE-2025-41234",
  "modified": "2026-05-20T15:22:51Z",
  "published": "2025-06-12T22:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-41234"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41234"
    },
    {
      "type": "REPORT",
      "url": "https://spring.io/security/cve-2025-41234"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-41234"
  ]
}

CVE-2025-41234 (GCVE-0-2025-41234)

Vulnerability from cvelistv5 – Published: 2025-06-12 21:14 – Updated: 2025-06-13 14:03

Title

RFD Attack via “Content-Disposition” Header Sourced from Request

Summary

Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input. Specifically, an application is vulnerable when all the following are true: * The header is prepared with org.springframework.http.ContentDisposition. * The filename is set via ContentDisposition.Builder#filename(String, Charset). * The value for the filename is derived from user-supplied input. * The application does not sanitize the user-supplied input. * The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details). An application is not vulnerable if any of the following is true: * The application does not set a “Content-Disposition” response header. * The header is not prepared with org.springframework.http.ContentDisposition. * The filename is set via one of: * ContentDisposition.Builder#filename(String), or * ContentDisposition.Builder#filename(String, ASCII) * The filename is not derived from user-supplied input. * The filename is derived from user-supplied input but sanitized by the application. * The attacker cannot inject malicious content in the downloaded content of the response. Affected Spring Products and VersionsSpring Framework: * 6.2.0 - 6.2.7 * 6.1.0 - 6.1.20 * 6.0.5 - 6.0.28 * Older, unsupported versions are not affected MitigationUsers of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix versionAvailability6.2.x6.2.8OSS6.1.x6.1.21OSS6.0.x6.0.29 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. CWE-113 in `Content-Disposition` handling in VMware Spring Framework versions 6.0.5 to 6.2.7 allows remote attackers to launch Reflected File Download (RFD) attacks via unsanitized user input in `ContentDisposition.Builder#filename(String, Charset)` with non-ASCII charsets.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Assigner

vmware

References

3 references

URL	Tags
https://spring.io/security/cve-2025-41234
https://nvd.nist.gov/vuln/detail/CVE-2025-41234
https://nvd.nist.gov/vuln-metrics/cvss/v3-calcula…

Impacted products

1 product

Vendor	Product	Version
VMware	Spring Framework	Affected: 6.0.5 , ≤ 6.0.28 (COMMERCIAL) Affected: 6.1.0 , ≤ 6.1.20 (OSS) Affected: 6.2.0 , ≤ 6.2.7 (OSS)

Date Public

2025-06-12 21:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41234",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-13T14:03:20.791564Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-13T14:03:35.406Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Framework",
          "vendor": "VMware",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.0.29",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.0.28",
              "status": "affected",
              "version": "6.0.5",
              "versionType": "COMMERCIAL"
            },
            {
              "changes": [
                {
                  "at": "6.1.21",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.1.20",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "OSS"
            },
            {
              "changes": [
                {
                  "at": "6.2.8",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.2.7",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "OSS"
            }
          ]
        }
      ],
      "datePublic": "2025-06-12T21:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003ch1\u003eDescription\u003c/h1\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eIn Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a \u201cContent-Disposition\u201d header with a non-ASCII charset, where the filename attribute is derived from user-supplied input.\u003c/p\u003e\u003cp\u003eSpecifically, an application is vulnerable when all the following are true:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe header is prepared with \u003ccode\u003eorg.springframework.http.ContentDisposition\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eThe filename is set via \u003ccode\u003eContentDisposition.Builder#filename(String, Charset)\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eThe value for the filename is derived from user-supplied input.\u003c/li\u003e\u003cli\u003eThe application does not sanitize the user-supplied input.\u003c/li\u003e\u003cli\u003eThe downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details).\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eAn application is not vulnerable if any of the following is true:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe application does not set a \u201cContent-Disposition\u201d response header.\u003c/li\u003e\u003cli\u003eThe header is not prepared with \u003ccode\u003eorg.springframework.http.ContentDisposition\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eThe filename is set via one of:\u003cul\u003e\u003cli\u003e\u003ccode\u003eContentDisposition.Builder#filename(String)\u003c/code\u003e, or\u003c/li\u003e\u003cli\u003e\u003ccode\u003eContentDisposition.Builder#filename(String, ASCII)\u003c/code\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003eThe filename is not derived from user-supplied input.\u003c/li\u003e\u003cli\u003eThe filename is derived from user-supplied input but sanitized by the application.\u003c/li\u003e\u003cli\u003eThe attacker cannot inject malicious content in the downloaded content of the response.\u003c/li\u003e\u003c/ul\u003e\u003ch1\u003eAffected Spring Products and Versions\u003c/h1\u003e\u003cp\u003eSpring Framework:\u003c/p\u003e\u003cul\u003e\u003cli\u003e6.2.0 - 6.2.7\u003c/li\u003e\u003cli\u003e6.1.0 - 6.1.20\u003c/li\u003e\u003cli\u003e6.0.5 - 6.0.28\u003c/li\u003e\u003cli\u003eOlder, unsupported versions are not affected\u003c/li\u003e\u003c/ul\u003e\u003ch1\u003eMitigation\u003c/h1\u003e\u003cp\u003eUsers of affected versions should upgrade to the corresponding fixed version.\u003c/p\u003e\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eAffected version(s)\u003c/th\u003e\u003cth\u003eFix version\u003c/th\u003e\u003cth\u003eAvailability\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e6.2.x\u003c/td\u003e\u003ctd\u003e6.2.8\u003c/td\u003e\u003ctd\u003eOSS\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e6.1.x\u003c/td\u003e\u003ctd\u003e6.1.21\u003c/td\u003e\u003ctd\u003eOSS\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e6.0.x\u003c/td\u003e\u003ctd\u003e6.0.29\u003c/td\u003e\u003ctd\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://enterprise.spring.io/\"\u003eCommercial\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cp\u003eNo further mitigation steps are necessary.\u003c/p\u003e\u003cbr\u003eCWE-113 in `Content-Disposition` handling in VMware Spring Framework versions 6.0.5 to 6.2.7 allows remote attackers to launch Reflected File Download (RFD) attacks via unsanitized user input in `ContentDisposition.Builder#filename(String, Charset)` with non-ASCII charsets."
            }
          ],
          "value": "Description\n\nIn Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a \u201cContent-Disposition\u201d header with a non-ASCII charset, where the filename attribute is derived from user-supplied input.\n\nSpecifically, an application is vulnerable when all the following are true:\n\n  *  The header is prepared with org.springframework.http.ContentDisposition.\n  *  The filename is set via ContentDisposition.Builder#filename(String, Charset).\n  *  The value for the filename is derived from user-supplied input.\n  *  The application does not sanitize the user-supplied input.\n  *  The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details).\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not set a \u201cContent-Disposition\u201d response header.\n  *  The header is not prepared with org.springframework.http.ContentDisposition.\n  *  The filename is set via one of:  *  ContentDisposition.Builder#filename(String), or\n  *  ContentDisposition.Builder#filename(String, ASCII)\n\n\n\n  *  The filename is not derived from user-supplied input.\n  *  The filename is derived from user-supplied input but sanitized by the application.\n  *  The attacker cannot inject malicious content in the downloaded content of the response.\n\n\nAffected Spring Products and VersionsSpring Framework:\n\n  *  6.2.0 - 6.2.7\n  *  6.1.0 - 6.1.20\n  *  6.0.5 - 6.0.28\n  *  Older, unsupported versions are not affected\n\n\nMitigationUsers of affected versions should upgrade to the corresponding fixed version.\n\nAffected version(s)Fix versionAvailability6.2.x6.2.8OSS6.1.x6.1.21OSS6.0.x6.0.29 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary.\n\n\nCWE-113 in `Content-Disposition` handling in VMware Spring Framework versions 6.0.5 to 6.2.7 allows remote attackers to launch Reflected File Download (RFD) attacks via unsanitized user input in `ContentDisposition.Builder#filename(String, Charset)` with non-ASCII charsets."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Allows Reflected File Download (RFD) leading to potential compromise of confidentiality and integrity through malicious content injection in downloaded files."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Response Splitting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-12T21:14:42.957Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2025-41234"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41234"
        },
        {
          "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N\u0026version=3.1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RFD Attack via \u201cContent-Disposition\u201d Header Sourced from Request",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-41234",
    "datePublished": "2025-06-12T21:14:42.957Z",
    "dateReserved": "2025-04-16T09:29:46.972Z",
    "dateUpdated": "2025-06-13T14:03:35.406Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

ubuntu-cve-2025-41234

Vulnerability from osv_ubuntu

CVE-2025-41234 (GCVE-0-2025-41234)

Tags

Sightings

Nomenclature