CVE-2025-41243: Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.
An application should be considered vulnerable when all the following are true:
The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). Spring Boot actuator is a dependency. The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. The actuator endpoints are available to attackers. The actuator endpoints are unsecured.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41243?
CVE-2025-41243 has not been assigned a specific severity rating yet, but it poses a risk of property modification in Spring Cloud Gateway Server Webflux.
How do I fix CVE-2025-41243?
To fix CVE-2025-41243, update your Spring Cloud Gateway Server Webflux to the latest version where this vulnerability is addressed.
Which versions of Spring Cloud Gateway are affected by CVE-2025-41243?
CVE-2025-41243 affects all versions of Spring Cloud Gateway Server Webflux prior to the fix.
What are the potential impacts of CVE-2025-41243?
The potential impacts of CVE-2025-41243 include unauthorized modification of Spring Environment properties, leading to security misconfigurations.
Is CVE-2025-41243 publicly disclosed?
Yes, CVE-2025-41243 has been publicly disclosed and is documented in the CVE database.