Do Son Spring fixed two flaws: CVE-2025-41253 allows SpEL injection in Cloud Gateway to expose secrets, and CVE-2025-41254 allows STOMP CSRF to send unauthorized WebSocket messages. Update immediately.
Spring Cloud Gateway
A critical flaw (CVE-2025-41243) in Spring Cloud Gateway with a CVSS 10.0 score allows unauthenticated RCE via SpEL injection. A PoC has been released.
A critical flaw in Spring Cloud Gateway (CVE-2025-41243) has a CVSS 10.0 score. The bug allows property modification when actuator endpoints are exposed. Update now.
A critical Spring Cloud Gateway flaw allows header spoofing from untrusted proxies. Update to fix or disable forwarding.