Security Bulletin: Vulnerabilities in Netty,Spring Boot,ZDRES-232,Apache HttpComponents,Spring Security,PostCSS,spring-cloud-gateway-server might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Spring Boot, ZDRES-232, Apache HttpComponents,Spring Security, PostCSS,spring-cloud-gateway-server. Vulnerabilities include attacker supplies com.myapp.SomeClass causes clinit of SomeClass â€" and many...

ch.nexsol-tech.gateway:sample-gateway (>=1.5.0, <=1.7.0), ch.nexsol-tech.gateway:spring-cloud-gateway-audit-core (>=1.5.0, <=1.14.2) +87 more potentially affected by CVE-2026-47879 via org.springframework.cloud:spring-cloud-gateway-server-webflux (>=5.0.0, <=5.0.2)

org.springframework.cloud:spring-cloud-gateway-server-webflux MAVEN version =5.0.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.5.0, =1.12.0, =1.6.0, =1.5.0, =1.14.2 and more Source cves: C...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the JsonToGrpcGatewayFilterFactory process, which permits arbitrary Spring Resource locations to be specified for proto descriptor definitions. An attacker can access internal files or perform...

com.codbex.atlas:codbex-atlas-application (>=2.80.0, <=2.109.0), com.codbex.phoebe:codbex-phoebe-application (>=0.2.0, <=3.32.0) +13 more potentially affected by CVE-2026-47825 via org.springframework.cloud:spring-cloud-gateway-server-mvc (>=4.1.0, <=4.3.4)

org.springframework.cloud:spring-cloud-gateway-server-mvc MAVEN version =4.1.0, =2.80.0, =0.2.0, =0.1.0, =0.2.1, =12.23.0, =12.23.0, =12.23.0, =12.23.0, =4.1.3, =4.3.0, =4.1.0, =4.3.0, =1.3.0, =1.3.1 Source cves: CVE-2026-47825https://vulners.com/cve/CVE-2026...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +141 more potentially affected by CVE-2026-47825 via org.springframework.cloud:spring-cloud-gateway-server (>=4.0.0, <=4.3.4)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =4.0.0, =0.2.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =3.0.0, =1.0.0, =1.0.0, =2023.4.1.0, =1.0.5, =1.0.4, =jdk17-0.0.1, =3.0.0.1 and more Source cves: CVE-2026-47825 Source advisory:...

ch.nexsol-tech.gateway:sample-gateway (>=0.0.1, <=1.0.0), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=0.0.1, <=1.0.0) +27 more potentially affected by CVE-2026-22750 via org.springframework.cloud:spring-cloud-gateway-server (4.2.0)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: - ch.nexsol-tech.gateway:sample-gateway =0.0.1, =0.0.1,...

ch.nexsol-tech.gateway:sample-gateway (>=0.0.1, <=1.0.0), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=0.0.1, <=1.0.0) +27 more potentially affected by CVE-2026-22750 via org.springframework.cloud:spring-cloud-gateway-server (4.2.0)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: - ch.nexsol-tech.gateway:sample-gateway =0.0.1, =0.0.1,...

cc.cc4414:cc-spring-cloud-starter-gateway (0.8.0), cn.futuai.open:futu-api-encrypt-spring-cloud-gateway-starter (>=1.1.0, <=1.3.4) +14 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (2.2.6.release)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 2.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: - cc.cc4414:cc-spring-cloud-starter-gateway 0.8...

cn.infrabase:infrabase-cloud-gateway (0.0.1), cn.infrabase:infrabase-platform-gateway (0.0.1) +26 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (2.2.9.release)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 2.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: - cn.infrabase:infrabase-cloud-gateway 0.0.1 -...

cn.katool.security:katool-security-gateway-spring-cloud-gateway-starter (1.1.1.release), com.buession.springcloud:buession-springcloud-gateway (>=1.3.2, <=2.3.3) +5 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (2.2.10.release)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 2.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: -...

cn.acyou:leo-gateway (>=1.0.0.release, <=1.1.1.release), cn.bbwres:biscuit-gateway-boot-starter (>=0.0.1, <=0.0.7) +138 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=3.0.0, <=3.1.10)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =3.0.0, =1.0.0.release, =0.0.1, =0.0.2, =1.0.0, =0.0.2, =8.1.0.286, =8.1.0.286, =8.1.0.585.9 and more Source cves: CVE-2025-41253 Source advisory: OSV:GHSA-FWXX-WV44-7QFG...

cn.acyou:leo-gateway (>=1.0.0.release, <=1.1.1.release), cn.bbwres:biscuit-gateway-boot-starter (>=0.0.1, <=0.0.7) +138 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=3.0.0, <=3.1.10)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =3.0.0, =1.0.0.release, =0.0.1, =0.0.2, =1.0.0, =0.0.2, =8.1.0.286, =8.1.0.286, =8.1.0.585.9 and more Source cves: CVE-2025-41253 Source advisory: GHSA-FWXX-WV44-7QFG...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +99 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=4.0.0, <=4.1.9)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =4.0.0, =0.2.0, =1.0.0, =1.0.0, =2023.4.1.0, =1.0.5, =1.0.4, =jdk17-0.0.1, =15.0-release, =1.0.0, =0.11.0, =0.1.0, =4.0.5, =0.9.0, =0.11.0 and more Source cves: CVE-2025-41253 Source advisory: OSV:GHSA-FWXX-WV44-7QFG...

com.buession.springcloud:buession-springcloud-gateway (>=1.2.1, <=1.2.2), com.github.sparkzxl:sparkzxl-gateway-filter (>=1.0, <=1.3.5) +8 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (2.2.7.release)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 2.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: -...

com.github.fanzezhen.common:common-gateway (2.1.0), com.github.fanzezhen.common:common-gateway-endpoint-auth (2.1.0) +8 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (2.2.8.release)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 2.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: - com.github.fanzezhen.common:common-gateway...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +99 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=4.0.0, <=4.1.9)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =4.0.0, =0.2.0, =1.0.0, =1.0.0, =2023.4.1.0, =1.0.5, =1.0.4, =jdk17-0.0.1, =15.0-release, =1.0.0, =0.11.0, =0.1.0, =4.0.5, =0.9.0, =0.11.0 and more Source cves: CVE-2025-41253 Source advisory: GHSA-FWXX-WV44-7QFG...

ch.nexsol-tech.gateway:sample-gateway (>=0.0.1, <=1.1.0), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=0.0.1, <=1.1.0) +45 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=4.2.0, <=4.2.5)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =4.2.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =15.13-release, =2.0.0, =1.0.0, =0.11.1, =0.11.1, =1.6.0, =3.4.5, =3.4.6 and more Source cves: CVE-2025-41253 Source advisory: OSV:GHSA-FWXX-WV44-7QFG...

ch.nexsol-tech.gateway:sample-gateway (>=0.0.1, <=1.1.0), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=0.0.1, <=1.1.0) +45 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=4.2.0, <=4.2.5)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =4.2.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =15.13-release, =2.0.0, =1.0.0, =0.11.1, =0.11.1, =1.6.0, =3.4.5, =3.4.6 and more Source cves: CVE-2025-41253 Source advisory: GHSA-FWXX-WV44-7QFG...

ch.nexsol-tech.gateway:sample-gateway (>=1.2.0, <=1.3.1), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=1.2.0, <=1.3.1) +40 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=4.3.0, <=4.3.1)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =4.3.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =3.0.0, =1.8.9, =0.12.1, =0.12.1, =0.12.10, =3.10.0-beta1, =3.11.0 and more Source cves: CVE-2025-41253 Source advisory: OSV:GHSA-FWXX-WV44-7QFG...

CVE-2025-41253

The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers. An application should be considered vulnerable when all the following are true: The application is using Spring Cloud Gateway Server...