CVE-2026-47825

The record

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).

Affected packages

Related vulnerabilities

• CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-346
• CVE-2026-107230 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-346
• CVE-2026-94485 Next.js is a React framework for building full-stack web applications. CWE-346
• CVE-2026-94486 Next.js is a React framework for building full-stack web applications. CWE-346
• CVE-2026-77119 A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity… CWE-346
• CVE-2026-87563 Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-346
• CVE-2026-85152 undici 8.10.0 omits the destination origin from the cache and request-deduplication keys… CWE-346
• CVE-2026-84482 WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability… CWE-346