org.springframework.cloud/spring-cloud-gateway-server-mvc vulnerabilities

Latest org.springframework.cloud/spring-cloud-gateway-server-mvc CVEs

Newest publication first

1. CVE-2025-41235 CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

   Published 2025-05-30

   High·CVSS 8.6 EPSS 0.36%

   Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.