CVE-2025-41253 - CVE House
Back to Database
Status published High CVE-2025-41253

Spring Cloud Gateway Webflux SpEL Injection Vulnerability Allowing Exposure of Environment Variables

Vulnerability Description

The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * An admin or untrusted third party using Spring Expression Language (SpEL) to access environment variables or system properties via routes. * An untrusted third party could create a route that uses SpEL to access environment variables or system properties if: * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway and management.endpoint.gateway.enabled=trueor management.endpoint.gateway.access=unrestricte. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-41253

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • This issue was responsibly reported by psytester.

References

More from VMware

View All →
CVE-2025-41254
Spring Framework STOMP CSRF Vulnerability
Medium 4.3
CVE-2025-41252
Username enumeration vulnerability
High 7.5
CVE-2025-41250
Header injection vulnerability
High 8.5
CVE-2025-41249
CVE-2025-41249: Spring Framework Annotation Detection Vulnerability
High 7.5
CVE-2025-41248
CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types
High 7.5

Affected Vendor

Affected Software

Spring Cloud Gateway Server Webflux
Vulnerable Versions:
3.1.x, 4.0.x, 4.1.x, 4.2.x, 4.3.x

Timeline

Official Publish: October 16th, 2025
Last Modified: October 16th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-917

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.