Code Injection Vulnerability in Spring Cloud Gateway by Pivotal Software
CVE-2025-41235
8.6HIGH
What is CVE-2025-41235?
The Spring Cloud Gateway Server is vulnerable to security risks due to improper handling of the X-Forwarded-For and Forwarded headers from untrusted proxies. This flaw can lead to potential code injection attacks, allowing malicious actors to exploit the server's ability to process these headers, posing a significant security risk to affected systems.
Affected Version(s)
Spring cloud Gateway Any 2.2.10.RELEASE - 4.2.2, 4.3.0-{M1, M2, RC1}
Spring Cloud Gateway Server MVC Any 4.1.7 - 4.2.2, 4.3.0-{M1, M2, RC1}