8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-41235

CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-41235

CVE-2025-41235:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.springframework.cloud:spring-cloud-gateway-server	maven	>= 4.2.0, < 4.2.3	4.2.3
org.springframework.cloud:spring-cloud-gateway-server	maven	>= 4.1.0, < 4.1.8	4.1.8
org.springframework.cloud:spring-cloud-gateway-server	maven	>= 4.0.0, <= 4.0.9
org.springframework.cloud:spring-cloud-gateway-server	maven	<= 3.1.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2025-41235 in Spring Cloud Gateway allows an attacker to send spoofed X-Forwarded-For and Forwarded headers through an untrusted proxy. The gateway would then incorrectly process these headers, potentially leading to security misconfigurations or bypasses, such as incorrect client IP identification.

The root cause is the lack of validation of the proxy's trustworthiness before processing these headers. The affected functions are primarily ForwardedHeadersFilter.filter and XForwardedHeadersFilter.filter (and their MVC counterparts ForwardedRequestHeadersFilter.apply and XForwardedRequestHeadersFilter.apply). These filters were responsible for parsing and applying the Forwarded and X-Forwarded-* headers to the downstream request.

The patch introduces a spring.cloud.gateway.trusted-proxies (and spring.cloud.gateway.mvc.trusted-proxies) configuration property. This property accepts a regular expression defining which proxies are considered trusted. The core filtering logic in ForwardedHeadersFilter and XForwardedHeadersFilter was modified to consult this list of trusted proxies. If the remote address of the connecting proxy (or the for field within an existing Forwarded header) does not match the trustedProxies pattern, the headers are either not added, or existing untrusted entries are stripped.

Additionally, a DefaultNettyHttpForwardedHeaderHandler was introduced, along with a NettyServerCustomizer in GatewayAutoConfiguration. This allows for the trustedProxies check to occur at the Netty server level, ensuring that connection information is only updated with forwarded headers if the immediate upstream proxy is trusted.

Therefore, when this vulnerability is exploited, the runtime profile would show activity within these header filtering functions as they process the malicious input. After the patch, these functions would first check against the trustedProxies configuration.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.