CVE-2025-41235 CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
Attackers can spoof IP addresses by injecting headers from untrusted proxies, bypassing IP-based security controls in Spring Cloud Gateway.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-41235?
CVE-2025-41235 is a high-severity vulnerability in VMware Spring Cloud Gateway Server MVC, published on 30 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
Weakness: CWE-444
Which versions are affected by CVE-2025-41235?
10 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-gateway-server-mvc and org.springframework.cloud:spring-cloud-gateway-server.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.cloud:spring-cloud-gateway-server-mvc Maven | From 4.1.7 | 4.2.3 |
org.springframework.cloud:spring-cloud-gateway-server-mvc Maven | From 4.1.7 | 4.2.3 |
org.springframework.cloud:spring-cloud-gateway-server Maven | All versions | 3.1.10 |
org.springframework.cloud:spring-cloud-gateway-server Maven | All versions | 3.1.10 |
org.springframework.cloud:spring-cloud-gateway-server Maven | From 4.0.0 to 4.0.9 | None |
org.springframework.cloud:spring-cloud-gateway-server Maven | From 4.0.0 to 4.0.9 | None |
4 more packages
org.springframework.cloud:spring-cloud-gateway-server Maven | From 4.1.0 | 4.1.8 |
org.springframework.cloud:spring-cloud-gateway-server Maven | From 4.1.0 | 4.1.8 |
org.springframework.cloud:spring-cloud-gateway-server Maven | From 4.2.0 | 4.2.3 |
org.springframework.cloud:spring-cloud-gateway-server Maven | From 4.2.0 | 4.2.3 |
How do I fix CVE-2025-41235?
Upgrade org.springframework.cloud:spring-cloud-gateway-server-mvc to 4.2.3 or later.
Is CVE-2025-41235 being exploited?
There is no known exploitation of CVE-2025-41235 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1777509591, GHSA-6j2q-c73v-97c5.