CVE-2025-41253: Spring Cloud Gateway Server Webflux Vulnerable to Expression Language Injection
Summary
CVE-2025-41253: Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection. Affects org.springframework.cloud:spring-cloud-gateway-server-webflux versions >= 3.1.0, <= 4.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Cloud Gateway Server Webflux is a framework designed to provide a simple, effective way to route to APIs and provide cross-cutting concerns such as security, monitoring, and resiliency. It leverages Spring's powerful programming model and integrates seamlessly with Spring Boot. However, certain versions of this package are vulnerable to an Expression Language Injection attack, which can expose sensitive environment variables and system properties to unauthorized users.
Vulnerability Detail
The vulnerability arises from the use of Spring Expression Language (SpEL) within the Spring Cloud Gateway Server Webflux. If an untrusted third party can create routes that utilize SpEL to access environment variables or system properties, they may exploit this to gain unauthorized access to sensitive information. This is particularly concerning if the actuator endpoints are unsecured and exposed to attackers. The vulnerability is present in versions 3.1.0 to 4.3.0, and it poses a significant risk as it allows attackers to manipulate the application's behavior and access sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling the actuator endpoints or securing them to prevent unauthorized access. You can restrict access by configuring the management endpoint settings in your application properties:
management.endpoints.web.exposure.include=none management.endpoint.gateway.enabled=false
Conclusion
In summary, CVE-2025-41253 poses a significant risk to applications using Spring Cloud Gateway Server Webflux versions 3.1.0 to 4.3.0. It is crucial to update to version 4.3.1 or later to mitigate this vulnerability. Additionally, securing actuator endpoints can help prevent unauthorized access.
See every vulnerability recorded for org.springframework.cloud:spring-cloud-gateway-server-webflux →
FAQ
CVE-2025-41253 is a vulnerability in Spring Cloud Gateway Server Webflux that allows attackers to exploit environment variables and system properties through Expression Language Injection.
The affected versions are from 3.1.0 to 4.3.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application without any signup using the Vulert playground at Vulert Scanner.
Actuator endpoints are management endpoints that provide insights into the application's health, metrics, and other operational information. If unsecured, they can be exploited by attackers.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.cloud:spring-cloud-gateway-server-webflux.
