CVE-2021-22051
Request injection in Spring Cloud Gateway
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
- Record
CVE-2021-22051- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
CVE List No score
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
- Record
CVE-2021-22051- Updated
- 2026-11-02
EUVDEUVD-2021-2279 No score
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
- Record
EUVD-2021-2279- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2r2v-q399-qq93
Request injection in Spring Cloud Gateway
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
- Record
GHSA-2r2v-q399-qq93- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-352, CWE-863
- Updated
- 2026-11-02
OSV
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
- Record
CVE-2021-22051- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-2r2v-q399-qq93
Request injection in Spring Cloud Gateway
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
- Record
GHSA-2r2v-q399-qq93- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-352, CWE-863
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.cloud:spring-cloud-gatewayMaven |
3.0.0 up to 3.0.5 | 3.0.5 |
org.springframework.cloud:spring-cloud-gatewayMaven |
2.2.0 to 2.2.10.RELEASE | 2.2.10.RELEASE0.5 |
org.springframework.cloud:spring-cloud-gatewayMaven |
3.0.0 up to 3.0.5, plus listed versions 3.0.13.0.23.0.33.0.4 |
3.0.5 |
org.springframework.cloud:spring-cloud-gatewayMaven |
2.2.0 up to 2.2.10.RELEASE0.5, plus listed versions 2.2.0.RELEASE2.2.1.RELEASE2.2.10.RELEASE2.2.2.RELEASE2.2.3.RELEASE Show 6 moreShow less2.2.4.RELEASE2.2.5.RELEASE2.2.6.RELEASE2.2.7.RELEASE2.2.8.RELEASE2.2.9.RELEASE |
2.2.10.RELEASE0.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-22051 is a medium vulnerability (CVSS 6.5) in Vmware Spring Cloud Gateway, published November 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in org.springframework.cloud:spring-cloud-gateway 3.0.5.