Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-5fa6-tx2k-eyad
Vulnerability ID VCID-5fa6-tx2k-eyad
Aliases CVE-2025-41243
GHSA-q2cj-h8fw-q4cc
Summary Spring Expression language property modification using Spring Cloud Gateway Server WebFlux Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
There are no known severity scores.
Reference id Reference type URL
CVE-2025-41243 https://nvd.nist.gov/vuln/detail/CVE-2025-41243
CVE-2025-41243 https://spring.io/security/cve-2025-41243
GHSA-q2cj-h8fw-q4cc https://github.com/advisories/GHSA-q2cj-h8fw-q4cc
No exploits are available.
There are no known vectors.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-02T04:47:49.011116+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework.cloud/spring-cloud-gateway-server-webflux/CVE-2025-41243.yml 38.6.0