CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-47825

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 7.0%

CVSS Severity

CVSS v3 Score 8.6

References

https://spring.io/security/cve-2026-47825

Products affected by CVE-2026-47825

Vmware » Spring Cloud Gateway » Version: N/A

cpe:2.3:a:vmware:spring_cloud_gateway:-
Vmware » Spring Cloud Gateway » Version: 1.0.0

cpe:2.3:a:vmware:spring_cloud_gateway:1.0.0
Vmware » Spring Cloud Gateway » Version: 1.0.1

cpe:2.3:a:vmware:spring_cloud_gateway:1.0.1
Vmware » Spring Cloud Gateway » Version: 1.0.2

cpe:2.3:a:vmware:spring_cloud_gateway:1.0.2
Vmware » Spring Cloud Gateway » Version: 1.0.3

cpe:2.3:a:vmware:spring_cloud_gateway:1.0.3
Vmware » Spring Cloud Gateway » Version: 2.0.0

cpe:2.3:a:vmware:spring_cloud_gateway:2.0.0
Vmware » Spring Cloud Gateway » Version: 2.0.1

cpe:2.3:a:vmware:spring_cloud_gateway:2.0.1
Vmware » Spring Cloud Gateway » Version: 2.0.2

cpe:2.3:a:vmware:spring_cloud_gateway:2.0.2
Vmware » Spring Cloud Gateway » Version: 2.0.3

cpe:2.3:a:vmware:spring_cloud_gateway:2.0.3
Vmware » Spring Cloud Gateway » Version: 2.0.4

cpe:2.3:a:vmware:spring_cloud_gateway:2.0.4
Vmware » Spring Cloud Gateway » Version: 2.1.0

cpe:2.3:a:vmware:spring_cloud_gateway:2.1.0
Vmware » Spring Cloud Gateway » Version: 2.1.1

cpe:2.3:a:vmware:spring_cloud_gateway:2.1.1
Vmware » Spring Cloud Gateway » Version: 2.1.2

cpe:2.3:a:vmware:spring_cloud_gateway:2.1.2
Vmware » Spring Cloud Gateway » Version: 2.1.3

cpe:2.3:a:vmware:spring_cloud_gateway:2.1.3
Vmware » Spring Cloud Gateway » Version: 2.1.4

cpe:2.3:a:vmware:spring_cloud_gateway:2.1.4
Vmware » Spring Cloud Gateway » Version: 2.1.5

cpe:2.3:a:vmware:spring_cloud_gateway:2.1.5
Vmware » Spring Cloud Gateway » Version: 2.2.0

cpe:2.3:a:vmware:spring_cloud_gateway:2.2.0
Vmware » Spring Cloud Gateway » Version: 2.2.1

cpe:2.3:a:vmware:spring_cloud_gateway:2.2.1
Vmware » Spring Cloud Gateway » Version: 2.2.10

cpe:2.3:a:vmware:spring_cloud_gateway:2.2.10
Vmware » Spring Cloud Gateway » Version: 2.2.2

cpe:2.3:a:vmware:spring_cloud_gateway:2.2.2
Vmware » Spring Cloud Gateway » Version: 2.2.3

cpe:2.3:a:vmware:spring_cloud_gateway:2.2.3
Vmware » Spring Cloud Gateway » Version: 2.2.4

cpe:2.3:a:vmware:spring_cloud_gateway:2.2.4
Vmware » Spring Cloud Gateway » Version: 2.2.5

cpe:2.3:a:vmware:spring_cloud_gateway:2.2.5
Vmware » Spring Cloud Gateway » Version: 2.2.6

cpe:2.3:a:vmware:spring_cloud_gateway:2.2.6
Vmware » Spring Cloud Gateway » Version: 2.2.7

cpe:2.3:a:vmware:spring_cloud_gateway:2.2.7
Vmware » Spring Cloud Gateway » Version: 2.2.8

cpe:2.3:a:vmware:spring_cloud_gateway:2.2.8
Vmware » Spring Cloud Gateway » Version: 2.2.9

cpe:2.3:a:vmware:spring_cloud_gateway:2.2.9
Vmware » Spring Cloud Gateway » Version: 3.0.0

cpe:2.3:a:vmware:spring_cloud_gateway:3.0.0
Vmware » Spring Cloud Gateway » Version: 3.0.1

cpe:2.3:a:vmware:spring_cloud_gateway:3.0.1
Vmware » Spring Cloud Gateway » Version: 3.0.2

cpe:2.3:a:vmware:spring_cloud_gateway:3.0.2
Vmware » Spring Cloud Gateway » Version: 3.0.3

cpe:2.3:a:vmware:spring_cloud_gateway:3.0.3
Vmware » Spring Cloud Gateway » Version: 3.0.4

cpe:2.3:a:vmware:spring_cloud_gateway:3.0.4
Vmware » Spring Cloud Gateway » Version: 3.0.5

cpe:2.3:a:vmware:spring_cloud_gateway:3.0.5
Vmware » Spring Cloud Gateway » Version: 3.0.6

cpe:2.3:a:vmware:spring_cloud_gateway:3.0.6
Vmware » Spring Cloud Gateway » Version: 3.0.7

cpe:2.3:a:vmware:spring_cloud_gateway:3.0.7
Vmware » Spring Cloud Gateway » Version: 3.0.8

cpe:2.3:a:vmware:spring_cloud_gateway:3.0.8
Vmware » Spring Cloud Gateway » Version: 3.1.0

cpe:2.3:a:vmware:spring_cloud_gateway:3.1.0
Vmware » Spring Cloud Gateway » Version: 3.1.1

cpe:2.3:a:vmware:spring_cloud_gateway:3.1.1
Vmware » Spring Cloud Gateway » Version: 3.1.10

cpe:2.3:a:vmware:spring_cloud_gateway:3.1.10
Vmware » Spring Cloud Gateway » Version: 3.1.2

cpe:2.3:a:vmware:spring_cloud_gateway:3.1.2
Vmware » Spring Cloud Gateway » Version: 3.1.3

cpe:2.3:a:vmware:spring_cloud_gateway:3.1.3
Vmware » Spring Cloud Gateway » Version: 3.1.4

cpe:2.3:a:vmware:spring_cloud_gateway:3.1.4
Vmware » Spring Cloud Gateway » Version: 3.1.5

cpe:2.3:a:vmware:spring_cloud_gateway:3.1.5
Vmware » Spring Cloud Gateway » Version: 3.1.6

cpe:2.3:a:vmware:spring_cloud_gateway:3.1.6
Vmware » Spring Cloud Gateway » Version: 3.1.7

cpe:2.3:a:vmware:spring_cloud_gateway:3.1.7
Vmware » Spring Cloud Gateway » Version: 3.1.8

cpe:2.3:a:vmware:spring_cloud_gateway:3.1.8
Vmware » Spring Cloud Gateway » Version: 3.1.9

cpe:2.3:a:vmware:spring_cloud_gateway:3.1.9
Vmware » Spring Cloud Gateway » Version: 4.3.0

cpe:2.3:a:vmware:spring_cloud_gateway:4.3.0
Vmware » Spring Cloud Gateway » Version: 4.3.1

cpe:2.3:a:vmware:spring_cloud_gateway:4.3.1
Vmware » Spring Cloud Gateway » Version: 4.3.2

cpe:2.3:a:vmware:spring_cloud_gateway:4.3.2
Vmware » Spring Cloud Gateway » Version: 4.3.3

cpe:2.3:a:vmware:spring_cloud_gateway:4.3.3
Vmware » Spring Cloud Gateway » Version: 4.3.4

cpe:2.3:a:vmware:spring_cloud_gateway:4.3.4
Vmware » Spring Cloud Gateway » Version: 5.0.0

cpe:2.3:a:vmware:spring_cloud_gateway:5.0.0
Vmware » Spring Cloud Gateway » Version: 5.0.1

cpe:2.3:a:vmware:spring_cloud_gateway:5.0.1

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-47825

Products

Pricing

Contact Us