Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.springframework.cloud:spring-cloud-gateway

3 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
5.0.4 (Oct 22, 2026): no advisory affects it
Newest unaffected release
5.0.4 (Oct 22, 2026), the latest release
Advisories
3 · 1 critical, 1 high
Dependents
0
Releases
93 since 1.0.0.RELEASE (Nov 22, 2017)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-22750
    Affects 4.2.0 (4.2.1 is outside it)
  • CVE-2022-22947
    Affects 1.0.0.RELEASE to 3.0.6 (3.0.7 is outside it); 3.1.0 (3.1.1 is outside it)
  • CVE-2021-22051
    Affects 2.2.0.RELEASE to 3.0.4 (3.0.5 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • SSL bundle configuration silently bypassed in Spring Cloud Gateway

    Affected: from 4.2.0, fixed in 4.2.1.

    Fixed in 4.2.1 (released Mar 18, 2025, 388 days before disclosure).

    The latest release, 5.0.4, is not affected.

  • CVE-2022-22947Critical 10.0 · KEV

    In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuat

    Affected: fixed in 3.0.7; from 3.1.0, fixed in 3.1.1.

    Fixed in 3.0.7 (released Feb 17, 2022, 14 days before disclosure) and 3.1.1 (released Feb 17, 2022, 14 days before disclosure).

    The latest release, 5.0.4, is not affected.

  • Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream…

    Affected: from 3.0.0, fixed in 3.0.5; from 2.2.0, fixed in 2.2.10.RELEASE0.5.

    Fixed in 3.0.5 (released Nov 3, 2021, 5 days before disclosure, the advisory names 2.2.10.RELEASE0.5, which was never published).

    The latest release, 5.0.4, is not affected.