PT-2026-49468 · Spring · Spring Cloud Gateway

Publicado 2026-06-15 · Atualizado 2026-06-15 · CVE-2026-47825

NVD

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.

Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

Identificadores relacionados

CVE-2026-47825

Produtos afetados

Spring Cloud Gateway

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-47825 · Nota de Segurança
• https://spring.io/security/cve-2026-47825 · Nota