Threats affecting pkg:maven/org.springframework.cloud/spring-cloud-gateway

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).

CVE-2026-22750 is a high-severity vulnerability in VMware Spring Cloud Gateway version 4.2.0 where the configuration property spring.ssl.bundle is silently ignored, causing the default SSL configuration to be used instead. This misconfiguration can lead to a loss of intended security controls related to SSL, potentially allowing an attacker to interfere with the integrity of the system. The 4.2.x branch is no longer supported in open source, and users are advised to upgrade to newer supported versions such as 5.0.

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.