CVE-2025-41235

Description

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

Affected packages (2)

• Maven/org.springframework.cloud:spring-cloud-gateway-server>= 4.2.0, < 4.2.3
• Maven/org.springframework.cloud:spring-cloud-gateway-server-mvc>= 4.1.7, < 4.2.3

CVSS scores

References (3)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-41235
• PATCHhttps://github.com/spring-cloud/spring-cloud-gateway
• WEBhttps://spring.io/security/cve-2025-41235