8.6

CVE-2026-47825

Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.

Affected versions:
Spring Cloud Gateway 3.1.x (fix 3.1.13).
Spring Cloud Gateway 4.1.x (fix 4.1.13).
Spring Cloud Gateway 4.2.x (fix 4.2.9).
Spring Cloud Gateway 4.3.x (fix 4.3.5).
Spring Cloud Gateway 5.0.x (fix 5.0.2).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Spring Cloud Gateway Version <= 3.1.10
VMware ≫ Spring Cloud Gateway Version >= 4.0.0 < 4.1.13
VMware ≫ Spring Cloud Gateway Version >= 4.2.0 < 4.2.9
VMware ≫ Spring Cloud Gateway Version >= 4.3.0 < 4.3.4.1
VMware ≫ Spring Cloud Gateway Version >= 5.0.0 < 5.0.1.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.14% 0.036
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
VMware 8.6 3.9 4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

https://spring.io/security/cve-2026-47825
Vendor Advisory