GHSA-q2cj-h8fw-q4cc: Spring Expression language property modification using Spring Cloud Gateway Server WebFlux

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2025-41243

Spring Expression language property modification using Spring Cloud Gateway Server WebFlux

Critical severity GitHub Reviewed Published Sep 16, 2025 to the GitHub Advisory Database • Updated Sep 16, 2025

Package

maven org.springframework.cloud:spring-cloud-gateway-server-webflux (Maven)

Affected versions

>= 3.1.0, <= 3.1.10

>= 4.0.0, <= 4.1.10

>= 4.2.0, < 4.2.5

>= 4.3.0, < 4.3.1

Patched versions

4.2.5

4.3.1

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.

An application should be considered vulnerable when all the following are true:

• The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
• Spring Boot actuator is a dependency.
• The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.
• The actuator endpoints are available to attackers.
• The actuator endpoints are unsecured.

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-41243
• https://spring.io/security/cve-2025-41243

Published to the GitHub Advisory Database

Sep 16, 2025

Last updated

Sep 16, 2025