SC
Product
Spring Cloud Gateway
On CISA KEVExploited in the wild
6
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 2Low 0
Watch
Add Spring Cloud Gateway to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-22947 In wildKEV | 10.0 | Mar 3 | VMware Spring Cloud Gateway Code Injection Vulnerability Affected: before 3.0.7; 3.1.0 |
| CVE-2026-47879 | 8.7 | Aug 27 | Spring Cloud Gateway SSRF and native file access with gRPC Affected: before 3.1.14; 4.0.0 before 4.2.10; 4.3.0 before 4.3.6; 5.0.0 before 5.0.3 |
| CVE-2026-47825 | 8.6 | Jun 15 | Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations Affected: through 3.1.10; 4.0.0 before 4.1.13; 4.2.0 before 4.2.9; 4.3.0 before 4.3.4.1; 5.0.0 before 5.0.1.1 |
| CVE-2026-22750 | 7.5 | Apr 10 | SSL bundle configuration silently bypassed in Spring Cloud Gateway Affected: 4.2.0 before 4.2.1 |
| CVE-2021-22051 | 6.5 | Nov 8 | Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services Affected: before 2.2.10; 3.0.0 before 3.0.5 |
| CVE-2022-22946 | 5.5 | Mar 4 | In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an… Affected: 3.1.0 |
Showing 6