CVE-2026-47879 Vmware CVE debrief

Who should care

Defenders and administrators of Spring Cloud Gateway deployments should assess exposure and verify versions. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and update affected versions to mitigate potential risks. They should also monitor for potential exploitation attempts and review compensating controls for exposed systems.

Why it matters

CVE-2026-47879 is a vulnerability in Spring Cloud Gateway that allows arbitrary Spring Resource locations, potentially leading to security issues. Defenders and administrators of Spring Cloud Gateway deployments should assess exposure, verify versions, and update affected versions to mitigate potential risks.

• Potential security risks due to arbitrary Spring Resource locations
• Need for version verification and updates
• Monitoring for potential exploitation attempts

Technical summary

The JsonToGrpcGatewayFilterFactory in Spring Cloud Gateway allows arbitrary Spring Resource locations for defining the proto descriptor, potentially leading to security issues. This vulnerability impacts defenders and administrators of Spring Cloud Gateway deployments, requiring them to assess exposure, verify versions, and update affected versions to mitigate potential risks. Affected product context includes Spring Cloud Gateway versions 3.1.13 and earlier, 4.0.0 - 4.2.9, 4.3.0 - 4.3.5, and 5.0.0 - 5.0.2. Defenders should prioritize verifying exposure and assessing potential impact.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact.

Recommended defensive actions

• Verify Spring Cloud Gateway version and assess exposure
• Review and update affected versions to 3.1.14, 4.2.10, 4.3.6, or 5.0.3
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Spring Cloud Gateway. Evidence is limited to public CVE and NVD information. Defenders should verify exposure and assess potential impact through official channels and vendor advisories. The CVE Program and NVD provide official details on this vulnerability, which affects Spring Cloud Gateway versions 3.1.13 and earlier, 4.0.0 - 4.2.9, 4.3.0 - 4.3.5, and 5.0.0 - 5.0.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.