CVE-2025-41243 - CVE House

Back to Database

Status published Critical CVE-2025-41243

Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

10 CVSS

Vulnerability Description

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-41243

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://spring.io/security/cve-2025-41243

More from Spring

View All →

CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods

Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed

Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation

Spring Framework DataBinder Case Sensitive Match Exception

Spring Cloud Config Server May Not Use Vault Token Sent By Clients

Affected Vendor

Spring

View all reports →

Affected Software

Cloud Gateway

Vulnerable Versions:

4.3.x, 4.2.x, 4.1.x, 4.0.x, 3.1.x

Timeline

Official Publish: September 16th, 2025

Last Modified: February 26th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1565.002 Stored Data Manipulation