VMware Spring Cloud Gateway vulnerabilities

Latest VMware Spring Cloud Gateway CVEs

Newest publication first

1. CVE-2026-47879 Spring Cloud Gateway SSRF and native file access with gRPC

   Published 2026-08-27

   High·CVSS 8.7 EPSS 0.33%

   Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier

2. CVE-2026-47825 Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations

   Published 2026-06-15

   High·CVSS 8.6 EPSS 0.18%

   Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1...

3. CVE-2026-22750 SSL bundle configuration silently bypassed in Spring Cloud Gateway

   Published 2026-04-10

   High·CVSS 7.5 EPSS 0.22%

   When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using S...

4. CVE-2025-41235 CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

   Published 2025-05-30

   High·CVSS 8.6 EPSS 0.36%

   Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

5. CVE-2022-22946 In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager....

   Published 2022-03-04

   Medium·CVSS 5.5 EPSS 4.8%

   In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custo...

6. CVE-2022-22947 Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

   Published 2022-03-03

   Critical·CVSS 10.0 EPSS 98.3% CISA KEV added 2022-05-16 Exploited in the wild Framework module Public exploit PoC

   In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote...

7. CVE-2021-22051 Request injection in Spring Cloud Gateway

   Published 2021-11-08

   Medium·CVSS 6.5 EPSS 0.67%

   Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.