CVE-2026-47825

EUVD-2026-37000
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.

Affected versions:
Spring Cloud Gateway 3.1.x (fix 3.1.13).
Spring Cloud Gateway 4.1.x (fix 4.1.13).
Spring Cloud Gateway 4.2.x (fix 4.2.9).
Spring Cloud Gateway 4.3.x (fix 4.3.5).
Spring Cloud Gateway 5.0.x (fix 5.0.2).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.6 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.02%
Affected Products (NVD)
VendorProductVersion
vmwarespring_cloud_gateway
𝑥
≤ 3.1.10
vmwarespring_cloud_gateway
4.0.0 ≤
𝑥
< 4.1.13
vmwarespring_cloud_gateway
4.2.0 ≤
𝑥
< 4.2.9
vmwarespring_cloud_gateway
4.3.0 ≤
𝑥
< 4.3.4.1
vmwarespring_cloud_gateway
5.0.0 ≤
𝑥
< 5.0.1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://spring.io/security/cve-2026-47825