Patchwire CVEs, their patch status, and feeds to follow them

CVE-2025-41235

Fixed upstream EPSS <1%CVSS 8.6

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

Published 2025-05-30 · CVE record · OSV

Products: vmware spring_cloud_gateway, VMware Spring Cloud Gateway Server MVC

Fixed upstream

EcosystemPackageFixed in
Mavenorg.springframework.cloud:spring-cloud-gateway-server4.2.3
Mavenorg.springframework.cloud:spring-cloud-gateway-server4.1.8
Mavenorg.springframework.cloud:spring-cloud-gateway-serverno fix
Mavenorg.springframework.cloud:spring-cloud-gateway-server3.1.10
Mavenorg.springframework.cloud:spring-cloud-gateway-server-mvc4.2.3