org.springframework.cloud/spring-cloud-gateway vulnerabilities

Latest org.springframework.cloud/spring-cloud-gateway CVEs

Newest publication first

1. CVE-2026-22750 SSL bundle configuration silently bypassed in Spring Cloud Gateway

   Published 2026-04-10

   High·CVSS 7.5

   When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using S...

2. CVE-2022-22947 Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

   Published 2022-03-03

   Critical·CVSS 10.0 EPSS 98.3% CISA KEV added 2022-05-16 Exploited in the wild Framework module Public exploit PoC

   In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote...

3. CVE-2021-22051 Request injection in Spring Cloud Gateway

   Published 2021-11-08

   Medium·CVSS 6.5 EPSS 0.67%

   Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.