The vulnerability in Spring Cloud Gateway 4.2.0 involves the improper handling of the spring.ssl.bundle configuration property. When this property is set, it is silently ignored, and the system falls back to the default SSL configuration. This behavior can cause the intended SSL bundle settings to be bypassed, potentially impacting the security posture of applications relying on customized SSL configurations. The issue is specific to version 4.2.0, with later versions in the 4.2.x branch and the 5.x branch providing fixes or improvements. The CVSS 3.1 score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

The impact of this vulnerability is that the intended SSL bundle configuration is not applied, which could allow an attacker to interfere with the integrity of the system's SSL handling. This may lead to scenarios where SSL protections are weaker than expected, potentially enabling man-in-the-middle or other integrity-related attacks. There is no confidentiality or availability impact reported. No known exploits in the wild have been identified.

No official patch or remediation level is explicitly provided in the available data. However, the vendor advisory recommends upgrading from version 4.2.0 to any newer 4.2.x release available on Maven Central or preferably to supported open source releases 5.0.2 or 5.1.1. Users should perform these upgrades to ensure the vulnerability is addressed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.