High severity8.6NVD Advisory· Published May 30, 2025· Updated Apr 15, 2026
CVE-2025-41235
CVE-2025-41235
Description
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.springframework.cloud:spring-cloud-gateway-serverMaven | >= 4.2.0, < 4.2.3 | 4.2.3 |
org.springframework.cloud:spring-cloud-gateway-serverMaven | >= 4.1.0, < 4.1.8 | 4.1.8 |
org.springframework.cloud:spring-cloud-gateway-serverMaven | >= 4.0.0, <= 4.0.9 | — |
org.springframework.cloud:spring-cloud-gateway-serverMaven | < 3.1.10 | 3.1.10 |
org.springframework.cloud:spring-cloud-gateway-server-mvcMaven | >= 4.1.7, < 4.2.3 | 4.2.3 |
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/advisories/GHSA-6j2q-c73v-97c5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-41235ghsaADVISORY
- spring.io/security/cve-2025-41235nvdWEB
News mentions
0No linked articles in our index yet.