VulnCheck KEV: CVE-2025-41243

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: The application is using Spring Cloud Gateway Server Webflux Spring Cloud Gateway Server WebMVC is not vulnerable...

Security Bulletin: Vulnerabilities in Netty,Spring Boot,ZDRES-232,Apache HttpComponents,Spring Security,PostCSS,spring-cloud-gateway-server might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Spring Boot, ZDRES-232, Apache HttpComponents,Spring Security, PostCSS,spring-cloud-gateway-server. Vulnerabilities include attacker supplies com.myapp.SomeClass causes clinit of SomeClass â€" and many...

ch.nexsol-tech.gateway:sample-gateway (>=1.5.0, <=1.7.0), ch.nexsol-tech.gateway:spring-cloud-gateway-audit-core (>=1.5.0, <=1.14.2) +87 more potentially affected by CVE-2026-47879 via org.springframework.cloud:spring-cloud-gateway-server-webflux (>=5.0.0, <=5.0.2)

org.springframework.cloud:spring-cloud-gateway-server-webflux MAVEN version =5.0.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.5.0, =1.12.0, =1.6.0, =1.5.0, =1.14.2 and more Source cves: C...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the JsonToGrpcGatewayFilterFactory process, which permits arbitrary Spring Resource locations to be specified for proto descriptor definitions. An attacker can access internal files or perform...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +141 more potentially affected by CVE-2026-47825 via org.springframework.cloud:spring-cloud-gateway-server (>=4.0.0, <=4.3.4)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =4.0.0, =0.2.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =3.0.0, =1.0.0, =1.0.0, =2023.4.1.0, =1.0.5, =1.0.4, =jdk17-0.0.1, =3.0.0.1 and more Source cves: CVE-2026-47825 Source advisory:...

com.codbex.atlas:codbex-atlas-application (>=2.80.0, <=2.109.0), com.codbex.phoebe:codbex-phoebe-application (>=0.2.0, <=3.32.0) +13 more potentially affected by CVE-2026-47825 via org.springframework.cloud:spring-cloud-gateway-server-mvc (>=4.1.0, <=4.3.4)

org.springframework.cloud:spring-cloud-gateway-server-mvc MAVEN version =4.1.0, =2.80.0, =0.2.0, =0.1.0, =0.2.1, =12.23.0, =12.23.0, =12.23.0, =12.23.0, =4.1.3, =4.3.0, =4.1.0, =4.3.0, =1.3.0, =1.3.1 Source cves: CVE-2026-47825https://vulners.com/cve/CVE-2026...

ch.nexsol-tech.gateway:sample-gateway (>=0.0.1, <=1.0.0), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=0.0.1, <=1.0.0) +27 more potentially affected by CVE-2026-22750 via org.springframework.cloud:spring-cloud-gateway-server (4.2.0)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: - ch.nexsol-tech.gateway:sample-gateway =0.0.1, =0.0.1,...

ch.nexsol-tech.gateway:sample-gateway (>=0.0.1, <=1.0.0), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=0.0.1, <=1.0.0) +27 more potentially affected by CVE-2026-22750 via org.springframework.cloud:spring-cloud-gateway-server (4.2.0)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: - ch.nexsol-tech.gateway:sample-gateway =0.0.1, =0.0.1,...

com.github.fanzezhen.common:common-gateway (2.1.0), com.github.fanzezhen.common:common-gateway-endpoint-auth (2.1.0) +8 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (2.2.8.release)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 2.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: - com.github.fanzezhen.common:common-gateway...

cn.infrabase:infrabase-cloud-gateway (0.0.1), cn.infrabase:infrabase-platform-gateway (0.0.1) +26 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (2.2.9.release)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 2.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: - cn.infrabase:infrabase-cloud-gateway 0.0.1 -...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +99 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=4.0.0, <=4.1.9)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =4.0.0, =0.2.0, =1.0.0, =1.0.0, =2023.4.1.0, =1.0.5, =1.0.4, =jdk17-0.0.1, =15.0-release, =1.0.0, =0.11.0, =0.1.0, =4.0.5, =0.9.0, =0.11.0 and more Source cves: CVE-2025-41253 Source advisory: OSV:GHSA-FWXX-WV44-7QFG...

ch.nexsol-tech.gateway:sample-gateway (>=0.0.1, <=1.1.0), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=0.0.1, <=1.1.0) +45 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=4.2.0, <=4.2.5)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =4.2.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =15.13-release, =2.0.0, =1.0.0, =0.11.1, =0.11.1, =1.6.0, =3.4.5, =3.4.6 and more Source cves: CVE-2025-41253 Source advisory: OSV:GHSA-FWXX-WV44-7QFG...

ch.nexsol-tech.gateway:sample-gateway (>=1.2.0, <=1.3.1), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=1.2.0, <=1.3.1) +40 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=4.3.0, <=4.3.1)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =4.3.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =3.0.0, =1.8.9, =0.12.1, =0.12.1, =0.12.10, =3.10.0-beta1, =3.11.0 and more Source cves: CVE-2025-41253 Source advisory: OSV:GHSA-FWXX-WV44-7QFG...

com.buession.springcloud:buession-springcloud-gateway (>=1.2.1, <=1.2.2), com.github.sparkzxl:sparkzxl-gateway-filter (>=1.0, <=1.3.5) +8 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (2.2.7.release)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 2.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: -...

cn.acyou:leo-gateway (>=1.0.0.release, <=1.1.1.release), cn.bbwres:biscuit-gateway-boot-starter (>=0.0.1, <=0.0.7) +138 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=3.0.0, <=3.1.10)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =3.0.0, =1.0.0.release, =0.0.1, =0.0.2, =1.0.0, =0.0.2, =8.1.0.286, =8.1.0.286, =8.1.0.585.9 and more Source cves: CVE-2025-41253 Source advisory: GHSA-FWXX-WV44-7QFG...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +99 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=4.0.0, <=4.1.9)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =4.0.0, =0.2.0, =1.0.0, =1.0.0, =2023.4.1.0, =1.0.5, =1.0.4, =jdk17-0.0.1, =15.0-release, =1.0.0, =0.11.0, =0.1.0, =4.0.5, =0.9.0, =0.11.0 and more Source cves: CVE-2025-41253 Source advisory: GHSA-FWXX-WV44-7QFG...

cc.cc4414:cc-spring-cloud-starter-gateway (0.8.0), cn.futuai.open:futu-api-encrypt-spring-cloud-gateway-starter (>=1.1.0, <=1.3.4) +14 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (2.2.6.release)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 2.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: - cc.cc4414:cc-spring-cloud-starter-gateway 0.8...

cn.katool.security:katool-security-gateway-spring-cloud-gateway-starter (1.1.1.release), com.buession.springcloud:buession-springcloud-gateway (>=1.3.2, <=2.3.3) +5 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (2.2.10.release)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version 2.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-gateway-server and may be impacted: -...

ch.nexsol-tech.gateway:sample-gateway (>=0.0.1, <=1.1.0), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=0.0.1, <=1.1.0) +45 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=4.2.0, <=4.2.5)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =4.2.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =15.13-release, =2.0.0, =1.0.0, =0.11.1, =0.11.1, =1.6.0, =3.4.5, =3.4.6 and more Source cves: CVE-2025-41253 Source advisory: GHSA-FWXX-WV44-7QFG...

cn.acyou:leo-gateway (>=1.0.0.release, <=1.1.1.release), cn.bbwres:biscuit-gateway-boot-starter (>=0.0.1, <=0.0.7) +138 more potentially affected by CVE-2025-41253 via org.springframework.cloud:spring-cloud-gateway-server (>=3.0.0, <=3.1.10)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =3.0.0, =1.0.0.release, =0.0.1, =0.0.2, =1.0.0, =0.0.2, =8.1.0.286, =8.1.0.286, =8.1.0.585.9 and more Source cves: CVE-2025-41253 Source advisory: OSV:GHSA-FWXX-WV44-7QFG...