CVE-2025-41235

CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

Published May 30, 2025 CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Description

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

VMware

Spring cloud Gateway

affected

Version	Status	Constraints
`2.2.10.RELEASE - 4.2.2, 4.3.0-{M1, M2, RC1}`	affected	< 4.3.0, 4.2.3, 4.1.8, 4.0.12, 3.1.10

VMware

Spring Cloud Gateway Server MVC

affected

Version	Status	Constraints
`4.1.7 - 4.2.2, 4.3.0-{M1, M2, RC1}`	affected	< 4.3.0, 4.2.3, 4.1.8

No data.

No data available yet.

No solution or workaround provided in the CVE record

Source	ID	Title
EUVD	EUVD-2025-16457	Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
Github GHSA	GHSA-6j2q-c73v-97c5	Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

No CVSS v4.0

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.357% probability within 30 days)

References

Link	Providers
https://spring.io/security/cve-2025-41235

History

Type	Values Removed	Values Added
Weaknesses		CWE-444
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
Title		CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
References		https://spring.io/security/cve-2025-41235
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N'}`