{"id":"CVE-2025-41243","aliases":["EUVD-2025-29611","GHSA-q2cj-h8fw-q4cc","ROOT-APP-MAVEN-CVE-2025-41243"],"status":"published","title":"Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux","description":"Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.\n\nAn application should be considered vulnerable when all the following are true:\n\n  *  The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).\n  *  Spring Boot actuator is a dependency.\n  *  The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.\n  *  The actuator endpoints are available to attackers.\n  *  The actuator endpoints are unsecured.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03674,"percentile":0.89743,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-917","CWE-94"],"published":"2025-09-16T14:54:57Z","modified":"2026-10-18T21:10:00Z","exploits":[{"source":"nuclei","id":"CVE-2025-41243","title":"Spring Cloud Gateway Server Webflux - Broken Access Control","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-41243.yaml"},{"source":"pocgithub","id":"SFN233/CVE-2025-41243-Vulnerability-Lab","title":"SFN233/CVE-2025-41243-Vulnerability-Lab","date":"2026-01-26","url":"https://github.com/SFN233/CVE-2025-41243-Vulnerability-Lab"}],"fixes":[{"ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway-server-webflux","fixed_in":["4.2.5","4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.cloud:spring-cloud-gateway-server-webflux","fixed_in":["4.3.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.cloud:spring-cloud-gateway-server-webflux","fixed_in":["4.3.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway-server-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"last_affected":"3.1.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway-server-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.1.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway-server-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway-server-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway-server-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"last_affected":"3.1.10"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway-server-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.1.10"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway-server-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-gateway-server-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.1"}]}],"versions":["4.3.0"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.cloud:spring-cloud-gateway-server-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.cloud:spring-cloud-gateway-server-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-root.io.1"}]}]}],"products":[{"vendor":"spring","product":"cloud gateway"}],"references":[{"url":"https://spring.io/security/cve-2025-41243","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-41243","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q2cj-h8fw-q4cc"}],"sources":{"cve":[{"id":"CVE-2025-41243","title":"Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux","description":"Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.\n\nAn application should be considered vulnerable when all the following are true:\n\n  *  The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).\n  *  Spring Boot actuator is a dependency.\n  *  The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.\n  *  The actuator endpoints are available to attackers.\n  *  The actuator endpoints are unsecured.","status":"published","published":"2025-09-16T14:54:57.396Z","modified":"2026-02-26T17:48:29.456Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-917","CWE-94"],"updated_at":"2026-11-02T14:32:31.631102Z"}],"euvd":[{"id":"EUVD-2025-29611","description":"Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.\n\nAn application should be considered vulnerable when all the following are true:\n\n  *  The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).\n  *  Spring Boot actuator is a dependency.\n  *  The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.\n  *  The actuator endpoints are available to attackers.\n  *  The actuator endpoints are unsecured.","status":"published","published":"2025-09-16T14:54:57Z","modified":"2026-02-26T17:48:29Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:21.697838Z"}],"ghsa":[{"id":"GHSA-q2cj-h8fw-q4cc","title":"Spring Expression language property modification using Spring Cloud Gateway Server WebFlux","description":"Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.\n\nAn application should be considered vulnerable when all the following are true:\n\n  *  The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).\n  *  Spring Boot actuator is a dependency.\n  *  The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.\n  *  The actuator endpoints are available to attackers.\n  *  The actuator endpoints are unsecured.","status":"published","published":"2025-09-16T15:32:37Z","modified":"2025-09-16T20:20:01Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:38:58.107905Z"}],"nvd":[{"id":"CVE-2025-41243","description":"Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.\n\nAn application should be considered vulnerable when all the following are true:\n\n  *  The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).\n  *  Spring Boot actuator is a dependency.\n  *  The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.\n  *  The actuator endpoints are available to attackers.\n  *  The actuator endpoints are unsecured.","status":"published","published":"2025-09-16T15:15:44.33Z","modified":"2026-10-18T21:10:00.12Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94","CWE-917"],"updated_at":"2026-11-02T14:11:29.650057Z"}],"osv":[{"id":"GHSA-q2cj-h8fw-q4cc","title":"Spring Expression language property modification using Spring Cloud Gateway Server WebFlux","description":"Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.\n\nAn application should be considered vulnerable when all the following are true:\n\n  *  The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).\n  *  Spring Boot actuator is a dependency.\n  *  The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.\n  *  The actuator endpoints are available to attackers.\n  *  The actuator endpoints are unsecured.","status":"published","published":"2025-09-16T15:32:37Z","modified":"2025-09-16T20:42:27.178022Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-41243","title":"CVE-2025-41243 in org.springframework.cloud:spring-cloud-gateway-server-webflux - Patched by Root","description":"Root has patched CVE-2025-41243 in the org.springframework.cloud:spring-cloud-gateway-server-webflux package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-01T03:38:46Z","modified":"2026-10-01T04:15:10.311660799Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}