AIKIDO-2025-10632

spring-cloud-gateway-server is vulnerable to Expression Language Injection

Expression Language InjectionCVE-2025-41243 Published Sep 11, 2025

Critical Risk

This Affects:

spring-cloud-gateway-server

3.0.0 - 3.1.10

Fixed in 3.1.11

4.0.0 - 4.1.10

Fixed in 4.1.11

4.2.0 - 4.2.4

Fixed in 4.2.5

4.3.0 - 4.3.0

Fixed in 4.3.1

Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to Expression Language (EL) injection in the GatewayEvaluationContext method, which allows attackers to modify properties and ultimately achieve remote code execution. This issue only affects WebFlux applications; WebMVC applications are not impacted.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range, and you expose the /actuator/gateway actuator endpoint via e.g. the Spring configuration setting management.endpoints.web.exposure.include=gateway (typically set via application.properties) in your Spring deployment/application.

Background info

spring-cloud-gateway-server is vulnerable to Expression Language Injection in versions 3.0.0 - 3.1.10, 4.0.0 - 4.1.10, 4.2.0 - 4.2.4 and 4.3.0 - 4.3.0.