CVE-2026-47825 Spring CVE debrief

Who should care

Defenders and administrators of Spring Cloud Gateway deployments should assess exposure and apply fixes to prevent potential header forwarding from untrusted proxies. This includes verifying configurations for WebMVC and WebFlux Gateway Servers, reviewing compensating controls, and tracking exceptions. Security teams and vulnerability management teams should also review the vulnerability and apply necessary mitigations.

Why it matters

CVE-2026-47825 affects Spring Cloud Gateway, potentially allowing header forwarding from untrusted proxies. Defenders and administrators should assess exposure and apply fixes to prevent potential security risks.

• Verify configurations for WebMVC and WebFlux Gateway Servers to prevent header forwarding.
• Apply fixes to prevent potential security risks associated with header forwarding.
• Review and update configurations to ensure secure proxy interactions.

Technical summary

CVE-2026-47825 affects Spring Cloud Gateway, causing forwarding of X-Forwarded-For and Forwarded headers from untrusted proxies in certain configurations. This impacts both WebMVC and WebFlux Gateway Servers. Affected versions include Spring Cloud Gateway 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x. Fixes are available in versions 3.1.13, 4.1.13, 4.2.9, 4.3.5, and 5.0.2. The vulnerability allows header forwarding from untrusted proxies, potentially leading to security risks. Defenders and administrators should assess exposure and apply fixes to prevent potential security risks.

Defensive priority

High

Recommended defensive actions

• Review and update Spring Cloud Gateway configurations to prevent forwarding of X-Forwarded-For and Forwarded headers from untrusted proxies.
• Apply fixes: upgrade to Spring Cloud Gateway 3.1.13, 4.1.13, 4.2.9, 4.3.5, or 5.0.2.
• Verify configurations for WebMVC and WebFlux Gateway Servers.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability in Spring Cloud Gateway, which forwards certain headers from untrusted proxies in specific configuration scenarios. The vulnerability affects Spring Cloud Gateway deployments, and defenders should verify configurations for WebMVC and WebFlux Gateway Servers to prevent header forwarding. Fixes are available in versions 3.1.13, 4.1.13, 4.2.9, 4.3.5, and 5.0.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.