Came across something in maestro-aws/gradle.lockfile around line 159 that looked worth flagging.
CVE-2025-41249 is a high‑severity vulnerability in Spring Framework 6.2.10 where the annotation detection logic can fail to resolve method annotations in generic type hierarchies. When @EnableMethodSecurity is used, this may cause security annotations (e.g., @PreAuthorize) on methods defined in generic super‑classes or interfaces to be ignored, potentially allowing unauthorized access or privilege escalation. The risk is high for applications that rely on method‑level security with generic types. The issue is fixed in Spring Framework 6.2.11, so upgrading the spring‑core dependency eliminates the flaw.
Something like this might fix it:
*** Begin Patch
*** Update File: maestro-aws/gradle.lockfile
@@
- org.springframework:spring-core:6.2.10
+ org.springframework:spring-core:6.2.11
*** End Patch
/*** Additionally, ensure the version is updated in the build script ***/
*** Begin Patch
*** Update File: build.gradle
@@
-implementation "org.springframework:spring-core:6.2.10"
+implementation "org.springframework:spring-core:6.2.11"
*** End Patch
For reference: rule CVE-2025-41249. Rated high.
If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
maestro-aws/gradle.lockfilearound line 159 that looked worth flagging.CVE-2025-41249 is a high‑severity vulnerability in Spring Framework 6.2.10 where the annotation detection logic can fail to resolve method annotations in generic type hierarchies. When @EnableMethodSecurity is used, this may cause security annotations (e.g., @PreAuthorize) on methods defined in generic super‑classes or interfaces to be ignored, potentially allowing unauthorized access or privilege escalation. The risk is high for applications that rely on method‑level security with generic types. The issue is fixed in Spring Framework 6.2.11, so upgrading the spring‑core dependency eliminates the flaw.
Something like this might fix it:
For reference: rule
CVE-2025-41249. Rated high.If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.