GHSA-6j2q-c73v-97c5HighCVSS 8.6

Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

Published
May 30, 2025
Last Modified
July 28, 2025

🔗 CVE IDs covered (1)

CVE-2025-41235 →

📋 Description

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

🎯 Affected products5

  • maven/org.springframework.cloud:spring-cloud-gateway-server:>= 4.2.0, < 4.2.3
  • maven/org.springframework.cloud:spring-cloud-gateway-server:>= 4.1.0, < 4.1.8
  • maven/org.springframework.cloud:spring-cloud-gateway-server:>= 4.0.0, <= 4.0.9
  • maven/org.springframework.cloud:spring-cloud-gateway-server:< 3.1.10
  • maven/org.springframework.cloud:spring-cloud-gateway-server-mvc:>= 4.1.7, < 4.2.3

🔗 References (3)