{"cve":"CVE-2025-41253","nvd":{"published":"2025-10-16T15:15:33.213","modified":"2026-10-09T10:10:00.193","status":"Deferred","description":"The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers.\n\nAn application should be considered vulnerable when all the following are true:\n\n  *  The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).\n  *  An admin or untrusted third party using Spring Expression Language (SpEL) to access environment variables or system properties via routes.\n  *  An untrusted third party could create a route that uses SpEL to access environment variables or system properties if:  *  The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway and management.endpoint.gateway.enabled=trueor management.endpoint.gateway.access=unrestricte.\n  *  The actuator endpoints are available to attackers.\n  *  The actuator endpoints are unsecured.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-917"],"references":["https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1","https://spring.io/security/cve/2025-41253"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:12:35.277909958+00:00"},"epss":{"cve":"CVE-2025-41253","score":0.00478,"percentile":0.40942,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-fwxx-wv44-7qfg","url":"https://osv.dev/vulnerability/GHSA-fwxx-wv44-7qfg","summary":"Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection","modified":"2026-02-19T22:21:56.841405Z","packages":[{"ecosystem":"Maven","name":"org.springframework.cloud:spring-cloud-gateway-server","purl":"pkg:maven/org.springframework.cloud/spring-cloud-gateway-server","ranges":[">=4.3.0 <4.3.2"],"fixed":["4.3.2"]},{"ecosystem":"Maven","name":"org.springframework.cloud:spring-cloud-gateway-server","purl":"pkg:maven/org.springframework.cloud/spring-cloud-gateway-server","ranges":[">=4.2.0 <4.2.6"],"fixed":["4.2.6"]},{"ecosystem":"Maven","name":"org.springframework.cloud:spring-cloud-gateway-server","purl":"pkg:maven/org.springframework.cloud/spring-cloud-gateway-server","ranges":[">=4.0.0 <=4.1.9"],"fixed":[]},{"ecosystem":"Maven","name":"org.springframework.cloud:spring-cloud-gateway-server","purl":"pkg:maven/org.springframework.cloud/spring-cloud-gateway-server","ranges":["<=3.1.10"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}