CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

Q: What is the severity of CVE-2025-41235?

The severity of CVE-2025-41235 is classified as critical due to the potential for unauthorized access and misuse of sensitive user information.

Q: How do I fix CVE-2025-41235?

To fix CVE-2025-41235, ensure that your Spring Cloud Gateway is configured to validate and sanitize headers from untrusted proxies.

Q: What is the impact of CVE-2025-41235?

The impact of CVE-2025-41235 includes the potential exposure of internal IP addresses and user data through manipulated headers.

Q: Which versions of Spring Cloud Gateway are affected by CVE-2025-41235?

CVE-2025-41235 affects all versions of Spring Cloud Gateway that do not have the necessary security configurations implemented.

Q: Is there a workaround for CVE-2025-41235 if I cannot update?

A temporary workaround for CVE-2025-41235 is to implement network-level controls to restrict access to trusted proxies.

Published May 30, 2025

Updated

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

Affected Software

6 affected componentsFixes available

Spring Cloud Gateway

maven/org.springframework.cloud:spring-cloud-gateway-server-mvc>=4.1.7<4.2.3

4.2.3

maven/org.springframework.cloud:spring-cloud-gateway-server<3.1.10

3.1.10

maven/org.springframework.cloud:spring-cloud-gateway-server>=4.0.0<=4.0.9

maven/org.springframework.cloud:spring-cloud-gateway-server>=4.1.0<4.1.8

4.1.8

maven/org.springframework.cloud:spring-cloud-gateway-server>=4.2.0<4.2.3

4.2.3

Event History

May 30, 2025

CVE Published

via MITRE·05:57 AM

Data Sourced

via MITRE·05:57 AM

DescriptionSeverity

Data Sourced

via NVD·06:15 AM

DescriptionSeverityWeakness

Advisory Published

via GitHub·06:30 AM

Frequently Asked Questions

What is the severity of CVE-2025-41235?

The severity of CVE-2025-41235 is classified as critical due to the potential for unauthorized access and misuse of sensitive user information.

How do I fix CVE-2025-41235?

To fix CVE-2025-41235, ensure that your Spring Cloud Gateway is configured to validate and sanitize headers from untrusted proxies.

What is the impact of CVE-2025-41235?

The impact of CVE-2025-41235 includes the potential exposure of internal IP addresses and user data through manipulated headers.

Which versions of Spring Cloud Gateway are affected by CVE-2025-41235?

CVE-2025-41235 affects all versions of Spring Cloud Gateway that do not have the necessary security configurations implemented.

Is there a workaround for CVE-2025-41235 if I cannot update?