Read the docs
TI-2021-05091 Aliases CVE-2021-22051GHSA-2r2v-q399-qq93

Incorrect authorization in Spring Cloud Gateway

Priority LOW 30CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Tampering
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863 and CWE-352.

Summary

Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.

Why it matters now

EPSS 0.00672 52nd percentileScored 2026-11-07
Fix Fixed org.springframework.cloud:spring-cloud-gateway (Maven): 3.0.5, 2.2.10.RELEASE0.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Spring Cloud Gateway3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older versions—No fix listedCNA
—org.springframework.cloud:spring-cloud-gateway (Maven)3.0.0 to before 3.0.53.0.5Patch availableGHSA-2r2v-q399-qq93
—org.springframework.cloud:spring-cloud-gateway (Maven)2.2.0 to before 2.2.10.RELEASE0.52.2.10.RELEASE0.5Patch availableGHSA-2r2v-q399-qq93
  • Spring Cloud Gateway Vendor— Affected 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older versions Fixed in — No fix listed CNA
  • org.springframework.cloud:spring-cloud-gateway (Maven) Vendor— Affected 3.0.0 to before 3.0.5 Fixed in 3.0.5 Patch available GHSA-2r2v-q399-qq93
  • org.springframework.cloud:spring-cloud-gateway (Maven) Vendor— Affected 2.2.0 to before 2.2.10.RELEASE0.5 Fixed in 2.2.10.RELEASE0.5 Patch available GHSA-2r2v-q399-qq93

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*before 2.2.10; 3.0.0 to before 3.0.5VulnerableVMware
  • cpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:* Versions before 2.2.10; 3.0.0 to before 3.0.5 Vulnerable ·VMware

Remediation

  • Fix · GHSA-2r2v-q399-qq93 org.springframework.cloud:spring-cloud-gateway (Maven) Fixed in 3.0.5 Advisory →
  • Fix · GHSA-2r2v-q399-qq93 org.springframework.cloud:spring-cloud-gateway (Maven) Fixed in 2.2.10.RELEASE0.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22051
  2. 2026-10-03 Alias added: GHSA-2r2v-q399-qq93

References

Advisory 2

  • TI-2022-07125 Code injection in Spring Cloud Gateway KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-35278 Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations CVSS 3.1HIGH 8.6
  • TI-2026-35327 Spring Cloud Gateway SSRF and native file access with gRPC CVSS 3.1HIGH 8.7
  • TI-2026-18273 SSL bundle configuration silently bypassed in Spring Cloud Gateway CVSS 3.1HIGH 7.5
  • TI-2022-07124 Improper certificate validation in Spring Cloud Gateway CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences