GitHub Advisoryadvisory · Maven

GHSA-6j2q-c73v-97c5 Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

HIGH Published 2025-05-30 Modified 2025-07-28 Official page ↗
Aliases
CVE-2025-41235
Ecosystem
Maven
Packages
org.springframework.cloud:spring-cloud-gateway-server, org.springframework.cloud:spring-cloud-gateway-server-mvc
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-444
Reviewed
2025-05-30

Affected packages

• Maven org.springframework.cloud:spring-cloud-gateway-server: >= 4.2.0, < 4.2.3 → fixed in 4.2.3 • Maven org.springframework.cloud:spring-cloud-gateway-server: >= 4.1.0, < 4.1.8 → fixed in 4.1.8 • Maven org.springframework.cloud:spring-cloud-gateway-server: >= 4.0.0, <= 4.0.9 (no fix yet) • Maven org.springframework.cloud:spring-cloud-gateway-server: < 3.1.10 → fixed in 3.1.10 • Maven org.springframework.cloud:spring-cloud-gateway-server-mvc: >= 4.1.7, < 4.2.3 → fixed in 4.2.3

Description

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

Related

Alias · CVE (1)

  • CVE-2025-41235 Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References