Spring Cloud Gateway versions 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x improperly forward the X-Forwarded-For and Forwarded headers from untrusted proxies in some configuration scenarios. This behavior can lead to an origin validation error, potentially allowing an attacker to spoof client IP addresses or manipulate request headers. The vulnerability affects both WebMVC and WebFlux Gateway Servers. Fixes have been released in versions 3.1.13, 4.1.13, 4.2.9, 4.3.5, and 5.0.2.

The vulnerability allows an attacker to influence the X-Forwarded-For and Forwarded headers, which may lead to incorrect client IP address identification or bypass of security controls relying on these headers. Although confidentiality is not impacted, the integrity of request headers is compromised, which can affect downstream processing and security decisions. Availability is not affected.

Fixed versions are available for all affected release lines: 3.1.13, 4.1.13, 4.2.9, 4.3.5, and 5.0.2. Users should upgrade to these versions to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is not explicitly confirmed in the vendor advisory content, but the presence of fixed versions indicates official fixes are available.