CVE-2026-47825

Опубликовано: 15 июн. 2026

Источник: nvd

CVSS3: 8.6

EPSS Низкий

Описание

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.

Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).

Ссылки

https://spring.io/security/cve-2026-47825

EPSS

Процентиль: 4%

0.00139

Низкий

8.6 High

CVSS3

Дефекты

CWE-346

Связанные уязвимости

CVE-2026-47825

CVSS3: 7.5

redhat

около 2 месяцев назад

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).

GHSA-hf28-w9wf-5x8m