Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

HIGH | MAY 27, 2025 | CVE-2025-41235

Description

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

Affected Spring Products and Versions

Spring Cloud Gateway:

4.2.0 - 4.2.2
4.1.0 - 4.1.7
4.0.0 - 4.0.11
3.1.9 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Fix version	Availability
4.2.3	OSS
4.1.8	OSS
4.0.12	Enterprise Support Only
3.1.10	Enterprise Support Only

The X-Forwarded-* and Forwarded header functionality will be disabled by default with the fix versions. If you require X-Forwarded-* or Forwarded header functionality, after upgrading you will need to do the following:

Set spring.cloud.gateway.trusted-proxies to a Java Regular Expression that specifies the proxies whose headers you trust. If you are using Spring Cloud Gateway Server MVC (only available from 4.1.x onward) set spring.cloud.gateway.mvc.trusted-proxies. For example for Spring Cloud Gateway Server:

spring.cloud.gateway.trusted-proxies=10\.0\.0\..*

For example for Spring Cloud Gateway Server MVC:

spring.cloud.gateway.mvc.trusted-proxies=10\.0\.0\..*

If you cannot upgrade, then you can:

Set spring.cloud.gateway.forwarded.enabled=false and spring.cloud.gateway.x-forwarded.enabled=false if you are using spring-cloud-starter-gateway or if you are using spring-cloud-starter-gateway-mvc (only available from 4.1.x onward) set spring.cloud.gateway.mvc.forwarded-request-headers-filter.enabled=false and spring.cloud.gateway.mvc.x-forwarded-request-headers-filter.enabled=false.