spring-cloud/spring-cloud-gateway · Security
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
- GHSA ID
- GHSA-6j2q-c73v-97c5
- CVE ID
- CVE-2025-41235
- Severity
- high
- Published
- Updated
- CVSS
- 8.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- CVSS v3
- 8.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Description
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
CWEs
- CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')