CVE-2025-41253
This Vulnerability has been fixed in the Never-Ending Support (NES) version offered by HeroDevs.
Overview
Spring Cloud Gateway is a library that provides an API gateway solution for microservices architectures. It offers a simple yet flexible way to route requests to microservices while providing cross-cutting concerns like security, monitoring, and resiliency through customizable filters. Built on a reactive foundation using Spring WebFlux, it provides high performance and scalability for handling large volumes of requests, while offering features like rate limiting, circuit breakers, request/response transformation, and load balancing out of the box.
A possible Information Exposure vulnerability (CVE-2025-41253) has been identified in Spring Cloud Gateway Server Webflux.
An information exposure vulnerability is a flaw in an application or system that allows an unauthorized user to access sensitive data that should be protected. This can include a wide range of information, such as user credentials, system details, source code, or personal data, which can then be used to craft targeted attacks, compromise accounts, and lead to identity theft, financial loss, or reputational damage.
This issue affects multiple versions of Spring Cloud Gateway’s spring-cloud-gateway-server package.
Details
Module Info
- Product: Spring Cloud Gateway
- Affected packages: spring-cloud-gateway-server
- Affected versions: >=3.1.0 <=3.1.11, >=4.0.0, >=4.1.0 <=4.1.11, >=4.2.0 <=4.2.5, >=4.3.0 <=4.3.1
- GitHub repository: https://github.com/spring-cloud/spring-cloud-gateway
- Published packages: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-gateway-server
- Package manager: Maven
- Fixed In: NES for Spring Cloud Gateway v3.1.15, v4.1.11
Vulnerability Info
The security flaw applies to Spring Cloud Gateway Webflux applications when specific deployment and configuration conditions align. Under certain conditions and configurations an application may be vulnerable to exposure of environment variables and system properties to attackers.
An application may be vulnerable when all of the following conditions are true:
- The application is using Spring Cloud Gateway Server Webflux.
- An admin or untrusted third party using Spring Expression Language (SpEL) to access environment variables or system properties via routes.
- An untrusted third party could create a route that uses SpEL to access environment variables or system properties. This can happen if:
- The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway and management.endpoint.gateway.enabled=true or management.endpoint.gateway.access=unrestricted
- The actuator endpoints are available to attackers.
- The actuator endpoints are unsecured.
Mitigation
Only recent versions of Spring Cloud Gateway are community-supported. Only the recent community supported version will receive updates to address this issue. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Spring Cloud Gateway
- Remove gateway from the management.endpoints.web.exposure.include property or secure the actuator endpoints.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
Credit
