CVE-2025-41235

HIGH

Org.springframework.cloud Spring-clou... - HTTP Request Smuggling

Title source: rule
STIX 2.1

Description

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

Scores

CVSS v3 8.6
EPSS 0.0039
EPSS Percentile 60.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-444
Status published
Products (4)
org.springframework.cloud/spring-cloud-gateway-server 4.2.0 - 4.2.3Maven
org.springframework.cloud/spring-cloud-gateway-server-mvc 4.1.7 - 4.2.3Maven
VMware/Spring cloud Gateway 2.2.10.RELEASE - 4.2.2, 4.3.0-{M1, M2, RC1} - 4.3.0, 4.2.3, 4.1.8, 4.0.12, 3.1.10
VMware/Spring Cloud Gateway Server MVC 4.1.7 - 4.2.2, 4.3.0-{M1, M2, RC1} - 4.3.0, 4.2.3, 4.1.8
Published May 30, 2025
Tracked Since Feb 18, 2026