Spring Security Advisories

RSS feed

Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations

HIGH | JUNE 11, 2026 | CVE-2026-47825

Description

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.

Affected Spring Products and Versions

Spring Cloud Gateway:

  • 5.0.0 - 5.0.1
  • 4.3.0 - 4.3.4
  • 4.2.0 - 4.2.8
  • 4.1.0 - 4.1.12
  • 3.1.0 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
Fix versionAvailability
5.0.2OSS
5.0.1.1Enterprise Support Only
4.3.5OSS
4.3.4.1Enterprise Support Only
4.2.9Enterprise Support Only
4.1.13Enterprise Support Only
3.1.13Enterprise Support Only

As part of this fix, the Spring Cloud Gateway Server WebFlux NettyServerCustomizer has been disabled by default. If you require this to be enabled, please set spring.cloud.gateway.server.webflux.httpserver.customizer-enabled=true for versions 5.0.x or 4.3.x if you have migrated to the new properties namespace, or spring.cloud.gateway.httpserver.customizer-enabled=true for 4.3.x if you have not migrated to the new properties namespace and for 4.2.x and 3.1.x.

Credit

The issue was identified and responsibly reported by samarthd.

References

History

  • 2026-06-11: Initial vulnerability report published.
  • 2026-06-12: Updated Fix version for 4.1.x from 4.2.9 to 4.1.13.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all