CVE-2025-41243: 
Java vulnerability analysis and mitigation

Spring Cloud Gateway Server Webflux contains a critical vulnerability (CVE-2025-41243) that enables Spring Environment property modification. The vulnerability was discovered and disclosed on September 8, 2025, affecting multiple versions of Spring Cloud Gateway from 3.1.0 through 4.3.x. This critical security flaw has been assigned the maximum CVSS score of 10.0, indicating its severe nature (Spring Security, NVD).

The vulnerability is specifically a Spring Expression Language (SpEL) injection vulnerability in the Spring Cloud Gateway actuator endpoint. The flaw exists in the GatewayEvaluationContext constructor, which creates an overly permissive evaluation context that doesn't disable property assignment. The vulnerability is present when specific conditions are met: the application uses Spring Cloud Gateway Server Webflux (WebMVC is not affected), Spring Boot actuator is a dependency, and the actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. The vulnerability has been assigned CWE-94 (Improper Control of Generation of Code) and CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement) (Miggo).

The vulnerability allows attackers to manipulate sensitive Spring Environment properties, potentially leading to remote code execution and compromise of application behavior. Given its deployment in microservices architectures as a reactive API gateway, often at network edges, successful exploitation could provide attackers with direct manipulation access to application runtime properties (Security Online).

Users of affected versions should upgrade to the following fixed versions: 4.3.x to 4.3.1 (OSS), 4.2.x to 4.2.5 (OSS), 4.1.x to 4.1.11 (Enterprise), and 3.1.x to 3.1.11 (Enterprise). For those unable to upgrade immediately, alternative mitigations include removing gateway from the management.endpoints.web.exposure.include property or implementing proper security controls for actuator endpoints (Spring Security).