CVE-2018-1275: Spring Framework STOMP over WebSocket broker message code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no privileges or interaction required and remote code execution impact, plus a very high EPSS score, warrant critical treatment despite the absence of KEV listing.

What it is

Spring Framework 5.0 before 5.0.5 and 4.3 before 4.3.16 let applications expose STOMP over WebSocket endpoints backed by a simple in-memory STOMP broker via spring-messaging. A crafted message to that broker can lead to remote code execution. This CVE covers the incomplete fix for CVE-2018-1270 in the 4.3.x branch, so 4.3.x deployments patched only for the earlier issue remain exposed.

Impact

An attacker who can send messages to the broker gains remote code execution in the context of the application, meaning full compromise of confidentiality, integrity and availability on the host.

Attack surface

Reached over the network through an exposed STOMP-over-WebSocket endpoint using the in-memory broker; the CVSS vector indicates no privileges and no user interaction are required. Only applications that actually expose such an endpoint with the simple broker are affected.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is high at roughly 0.58 (99th percentile), and references are patch and advisory only, with no public exploit tag in the record.

What to do

• Upgrade Spring Framework to 5.0.5 or later, or 4.3.16 or later; 4.3.x users who applied only the CVE-2018-1270 fix must apply this follow-up fix.
• Apply the linked Oracle, Red Hat and Pivotal vendor patches for bundled products that ship the affected Spring Framework.
• If the in-memory STOMP broker is not required, disable or remove the STOMP-over-WebSocket endpoint and use a hardened external broker instead.
• Restrict network access to WebSocket/STOMP endpoints to trusted clients and require authentication where the application permits it.

Detection

• Inspect Spring application configuration and dependencies for spring-messaging STOMP-over-WebSocket endpoints backed by the simple in-memory broker.
• Monitor WebSocket and STOMP traffic for anomalous or malformed message payloads targeting broker destinations.
• Watch for unexpected child processes, outbound connections or file writes originating from the Java application server hosting Spring.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.