Skip to content
OpenAdvisories
High · 8.6 CVE-2025-41235 EUVD-2025-16457GHSA-6j2q-c73v-97c5

CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

Published May 30, 2025 · Updated May 30, 2025 · Assigned by vmware

Vendor: VMware Product: Spring Cloud Gateway Product: Spring Cloud Gateway Server MVC Package: org.springframework.cloud:spring-cloud-gateway-server Package: org.springframework.cloud:spring-cloud-gateway-server-mvc Ecosystem: Maven

Description

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

Affected products

VendorProductAffectedFixed
VMware Spring cloud Gateway 2.2.10.RELEASE - 4.2.2, 4.3.0-{M1, M2, RC1} – < 4.3.0, 4.2.3, 4.1.8, 4.0.12, 3.1.10 4.3.0, 4.2.3, 4.1.8, 4.0.12, 3.1.10
VMware Spring Cloud Gateway Server MVC 4.1.7 - 4.2.2, 4.3.0-{M1, M2, RC1} – < 4.3.0, 4.2.3, 4.1.8 4.3.0, 4.2.3, 4.1.8

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.springframework.cloud:spring-cloud-gateway-server >= 4.2.0, < 4.2.3 4.2.3 GHSA-6j2q-c73v-97c5
Maven org.springframework.cloud:spring-cloud-gateway-server >= 4.1.0, < 4.1.8 4.1.8 GHSA-6j2q-c73v-97c5
Maven org.springframework.cloud:spring-cloud-gateway-server >= 4.0.0, <= 4.0.9 — GHSA-6j2q-c73v-97c5
Maven org.springframework.cloud:spring-cloud-gateway-server < 3.1.10 3.1.10 GHSA-6j2q-c73v-97c5
Maven org.springframework.cloud:spring-cloud-gateway-server-mvc >= 4.1.7, < 4.2.3 4.2.3 GHSA-6j2q-c73v-97c5

Advisories 1

References