high8.6
CVE-2025-41235
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
Impact
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.cloud:spring-cloud-gateway-server | >= 4.2.0, < 4.2.3 | 4.2.3 |
| maven | org.springframework.cloud:spring-cloud-gateway-server-mvc | >= 4.1.7, < 4.2.3 | 4.2.3 |