Spring Cloud Gateway vulnerabilities

2 known vulnerabilities in Spring Cloud Gateway from Spring. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  Spring Cloud Gateway: Server-Side Request Forgery

  CVE-2026-47879Aug 27, 2026Spring

  Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.

• 8.6 High severity

  Spring Cloud Gateway: Origin Validation Error

  CVE-2026-47825Jun 15, 2026Spring

  Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spri