CVE-2025-41243
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.
- CVSS 3.1
- 10.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS
- 3.5% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-94, CWE-917
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-q2cj-h8fw-q4cc | Maven | org.springframework.cloud:spring-cloud-gateway-server-webflux | >=3.1.0 <=3.1.10 | no fix published |
| GHSA-q2cj-h8fw-q4cc | Maven | org.springframework.cloud:spring-cloud-gateway-server-webflux | >=4.0.0 <=4.1.10 | no fix published |
| GHSA-q2cj-h8fw-q4cc | Maven | org.springframework.cloud:spring-cloud-gateway-server-webflux | >=4.2.0 <4.2.5 | 4.2.5 |
| GHSA-q2cj-h8fw-q4cc | Maven | org.springframework.cloud:spring-cloud-gateway-server-webflux | >=4.3.0 <4.3.1 | 4.3.1 |