CVE-2025-41243

Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

State: Published
Severity: 10.0 Critical
Published: Sep 16, 2025
Updated: Feb 26, 2026
Reserved: Apr 16, 2025

Description

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.

An application should be considered vulnerable when all the following are true:

* The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	vmware

Weaknesses

CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
Cloud GatewaySpring	4.3.x to before 4.3.1Affected 4.2.x to before 4.2.5Affected 4.1.x, 4.0.x to before 4.1.11Affected 3.1.x to before 3.1.11Affected

References

https://spring.io/security/cve-2025-41243

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.