Read the docs
TI-2026-18273 Aliases CVE-2026-22750GHSA-hwqh-2684-54fc

SSL bundle configuration silently bypassed in Spring Cloud Gateway

Priority LOW 38CWE-15Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0  available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1 which are the current supported open source releases.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00221 12th percentileScored 2026-11-07
Fix Fixed Spring Cloud Gateway (VMware): 4.2.1org.springframework.cloud:spring-cloud-gateway (Maven): 4.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring Cloud Gateway4.2.0 to before 4.2.14.2.1Patch availableCNA
—org.springframework.cloud:spring-cloud-gateway (Maven)4.2.0 to before 4.2.14.2.1Patch availableGHSA-hwqh-2684-54fc
  • Spring Cloud Gateway VendorVMware Affected 4.2.0 to before 4.2.1 Fixed in 4.2.1 Patch available CNA
  • org.springframework.cloud:spring-cloud-gateway (Maven) Vendor— Affected 4.2.0 to before 4.2.1 Fixed in 4.2.1 Patch available GHSA-hwqh-2684-54fc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_cloud_gateway:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableVMware
  • cpe:2.3:a:vmware:spring_cloud_gateway:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·VMware

Remediation

  • Fix · CNA Spring Cloud Gateway (VMware) Fixed in 4.2.1
  • Fix · GHSA-hwqh-2684-54fc org.springframework.cloud:spring-cloud-gateway (Maven) Fixed in 4.2.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22750
  2. 2026-10-03 Alias added: GHSA-hwqh-2684-54fc

References

Advisory 2

Other 4

  • TI-2022-07125 Code injection in Spring Cloud Gateway KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-35278 Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations CVSS 3.1HIGH 8.6
  • TI-2026-35327 Spring Cloud Gateway SSRF and native file access with gRPC CVSS 3.1HIGH 8.7
  • TI-2022-07124 Improper certificate validation in Spring Cloud Gateway CVSS 3.1MEDIUM 5.5
  • TI-2021-05091 Incorrect authorization in Spring Cloud Gateway CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences