CVE-2025-41243: Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-16 · updated 2026-10-18
Weakness: CWE-94

Description

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.

Affected products

Spring Cloud Gateway: from 4.3.x before 4.3.1; from 4.2.x before 4.2.5; from 4.1.x, 4.0.x before 4.1.11; from 3.1.x before 3.1.11 — fixed in 3.1.11, 4.1.11, 4.2.5, 4.3.1

How to fix

Upgrade to a fixed version: Spring Cloud Gateway 3.1.11, 4.1.11, 4.2.5, 4.3.1. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2025-41243

Get alerted when CVE-2025-41243 or the next vulnerability affects your stack