CVE-2025-41243: Spring Cloud Gateway Server Webflux Critical Vulnerability in Property Modification
Summary
CVE-2025-41243: Spring Expression language property modification using Spring Cloud Gateway Server WebFlux. Affects org.springframework.cloud:spring-cloud-gateway-server-webflux across 4 version ranges.
>= 3.1.0, <= 3.1.10
>= 4.0.0, <= 4.1.10
>= 4.2.0, < 4.2.5
>= 4.3.0, < 4.3.1
Fixed in 4.2.5 or 4.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Cloud Gateway Server Webflux is a framework that provides a simple, effective way to route to APIs and provides an excellent way to secure and manage microservices. It is built on top of Spring Framework and is designed to work seamlessly with Spring Boot applications. However, it has been identified that certain configurations can expose the application to critical vulnerabilities, particularly concerning the modification of Spring Environment properties.
Vulnerability Detail
The vulnerability arises from improper exposure of actuator endpoints in Spring Cloud Gateway Server Webflux applications. When the application has the Spring Boot actuator as a dependency and the actuator web endpoint for the gateway is enabled, it can lead to unauthorized property modifications if these endpoints are unsecured and accessible to attackers. This can result in significant security risks, including unauthorized access to sensitive application configurations.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.2.54.2.5 -
>= 4.3.0, < 4.3.14.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that actuator endpoints are secured and not publicly accessible. You can restrict access by configuring security settings in your application. For example, you can use Spring Security to secure your actuator endpoints:
@Configuration public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .antMatchers("/actuator/**").authenticated() .and() .httpBasic();
}
}
Conclusion
In summary, CVE-2025-41243 presents a critical risk for applications using Spring Cloud Gateway Server Webflux. It is essential to update to the latest patched versions and secure actuator endpoints to mitigate potential threats. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for org.springframework.cloud:spring-cloud-gateway-server-webflux →
FAQ
CVE-2025-41243 is a critical vulnerability in Spring Cloud Gateway Server Webflux that allows unauthorized modification of Spring Environment properties.
If your application uses Spring Cloud Gateway Server Webflux with Spring Boot actuator enabled and unsecured actuator endpoints, it may be vulnerable. You can check your application's dependencies using Vulert without any signup.
Exploitation of this vulnerability can lead to unauthorized access and modification of application configurations, potentially compromising the entire application.
You can secure your actuator endpoints by using Spring Security to restrict access to authenticated users only.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. You can check if your application is affected by vulnerabilities in real-time using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.cloud:spring-cloud-gateway-server-webflux.
