CVEvulnerability

CVE-2026-47825

8.6 HIGH Published 2026-06-15 Modified 2026-10-25 Official page ↗
Status
Analyzed
Published
2026-06-15
Last modified
2026-10-25
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-346

Description

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).

Affected configurations

• vmware spring cloud gateway (<= 3.1.10) • vmware spring cloud gateway (>= 4.0.0 < 4.1.13) • vmware spring cloud gateway (>= 4.2.0 < 4.2.9) • vmware spring cloud gateway (>= 4.3.0 < 4.3.4.1) • vmware spring cloud gateway (>= 5.0.0 < 5.0.1.1)

Related

Weakness · CWE (1)

  • CWE-346 Origin Validation Error weakness

References