Vulnerability-Lookup

CVE-2026-22750 (GCVE-0-2026-22750)

Vulnerability from cvelistv5 – Published: 2026-04-10 07:32 – Updated: 2026-04-10 12:59

Title

SSL bundle configuration silently bypassed in Spring Cloud Gateway

Summary

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1 which are the current supported open source releases.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-10 12:59 UTC

CWE

CWE-15 - External Control of System or Configuration Setting

Assigner

vmware CNA under the mitre root

CNA scorecard C 64/100 over 228 records in the last 180 days details

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-22750

Impacted products

1 product

Vendor	Product	Version	CPE status
VMware	Spring Cloud Gateway	Affected: 4.2.0 , < 4.2.1 (ENTERPRISE)	guessed

Date Public

2026-04-09 14:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22750",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-10T12:59:10.606788Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-15",
                "description": "CWE-15 External Control of System or Configuration Setting",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-10T12:59:14.451Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Spring Cloud Gateway",
          "product": "Spring Cloud Gateway",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "4.2.1",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "ENTERPRISE"
            }
          ]
        }
      ],
      "datePublic": "2026-04-09T14:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When configuring SSL bundles in Spring Cloud Gateway by using the configuration property\u0026nbsp;\u003ccode\u003espring.ssl.bundle\u003c/code\u003e, the configuration was silently ignored and the default SSL configuration was used instead.\u003cbr\u003eNote: The\u0026nbsp;\u003ccode\u003e4.2.x\u003c/code\u003e\u0026nbsp;branch is no longer under open source support. If you are using Spring Cloud Gateway\u0026nbsp;\u003ccode\u003e4.2.0\u003c/code\u003e\u0026nbsp;and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway\u0026nbsp;\u003ccode\u003e4.2.x\u003c/code\u003e\u0026nbsp;release newer than\u0026nbsp;\u003ccode\u003e4.2.0\u003c/code\u003e\u0026nbsp;\u003ca href=\"https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/\"\u003eavailable on Maven Centeral\u003c/a\u003e. Ideally if you are not an enterprise customer, you should be upgrading to\u0026nbsp;\u003ccode\u003e5.0.2\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003e5.1.1\u003c/code\u003e\u0026nbsp;which are the current supported open source releases."
            }
          ],
          "value": "When configuring SSL bundles in Spring Cloud Gateway by using the configuration property\u00a0spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead.\nNote: The\u00a04.2.x\u00a0branch is no longer under open source support. If you are using Spring Cloud Gateway\u00a04.2.0\u00a0and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway\u00a04.2.x\u00a0release newer than\u00a04.2.0\u00a0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to\u00a05.0.2\u00a0or\u00a05.1.1\u00a0which are the current supported open source releases."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-10T07:32:31.260Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-22750"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SSL bundle configuration silently bypassed in Spring Cloud Gateway",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-22750",
    "datePublished": "2026-04-10T07:32:31.260Z",
    "dateReserved": "2026-01-09T06:55:03.990Z",
    "dateUpdated": "2026-04-10T12:59:14.451Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-22750",
      "date": "2026-10-29",
      "epss": "0.00217",
      "percentile": "0.12217"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageName": "Spring Cloud Gateway",
                "product": "Spring Cloud Gateway",
                "vendor": "VMware",
                "versions": [
                  {
                    "lessThan": "4.2.1",
                    "status": "affected",
                    "version": "4.2.0",
                    "versionType": "ENTERPRISE"
                  }
                ]
              }
            ],
            "source": "security@vmware.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:vmware:spring_cloud_gateway:4.2.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9FC64DD6-416A-4D8E-B08B-376C318F4849",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "When configuring SSL bundles in Spring Cloud Gateway by using the configuration property\u00a0spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead.\nNote: The\u00a04.2.x\u00a0branch is no longer under open source support. If you are using Spring Cloud Gateway\u00a04.2.0\u00a0and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway\u00a04.2.x\u00a0release newer than\u00a04.2.0\u00a0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to\u00a05.0.2\u00a0or\u00a05.1.1\u00a0which are the current supported open source releases."
          },
          {
            "lang": "es",
            "value": "Al configurar paquetes SSL en Spring Cloud Gateway utilizando la propiedad de configuraci\u00f3n spring.ssl.bundle, la configuraci\u00f3n fue ignorada silenciosamente y se utiliz\u00f3 la configuraci\u00f3n SSL predeterminada en su lugar.\nNota: La rama 4.2.x ya no cuenta con soporte de c\u00f3digo abierto. Si est\u00e1 utilizando Spring Cloud Gateway 4.2.0 y no es un cliente empresarial, puede actualizar a cualquier versi\u00f3n de Spring Cloud Gateway 4.2.x posterior a 4.2.0 disponible en Maven Central https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/. Idealmente, si no es un cliente empresarial, deber\u00eda actualizar a 5.0.2 o 5.1.1, que son las versiones de c\u00f3digo abierto actualmente soportadas."
          }
        ],
        "id": "CVE-2026-22750",
        "lastModified": "2026-10-26T22:10:00.163",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security@vmware.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-22750",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-10T12:59:10.606788Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-04-10T08:16:24.787",
        "references": [
          {
            "source": "security@vmware.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://spring.io/security/cve-2026-22750"
          }
        ],
        "sourceIdentifier": "security@vmware.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-15"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:14:21+00:00",
      "cve": "CVE-2026-22750",
      "id": "CVE-2026-22750",
      "initial_release_date": "2026-04-09T14:15:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "SSL bundle configuration silently bypassed in Spring Cloud Gateway",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22750.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-22750",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-10T12:59:10.606788Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-15",
                    "description": "CWE-15 External Control of System or Configuration Setting",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-10T12:59:00.656Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageName": "Spring Cloud Gateway",
              "product": "Spring Cloud Gateway",
              "vendor": "VMware",
              "versions": [
                {
                  "lessThan": "4.2.1",
                  "status": "affected",
                  "version": "4.2.0",
                  "versionType": "ENTERPRISE"
                }
              ]
            }
          ],
          "datePublic": "2026-04-09T14:15:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "When configuring SSL bundles in Spring Cloud Gateway by using the configuration property\u0026nbsp;\u003ccode\u003espring.ssl.bundle\u003c/code\u003e, the configuration was silently ignored and the default SSL configuration was used instead.\u003cbr\u003eNote: The\u0026nbsp;\u003ccode\u003e4.2.x\u003c/code\u003e\u0026nbsp;branch is no longer under open source support. If you are using Spring Cloud Gateway\u0026nbsp;\u003ccode\u003e4.2.0\u003c/code\u003e\u0026nbsp;and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway\u0026nbsp;\u003ccode\u003e4.2.x\u003c/code\u003e\u0026nbsp;release newer than\u0026nbsp;\u003ccode\u003e4.2.0\u003c/code\u003e\u0026nbsp;\u003ca href=\"https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/\"\u003eavailable on Maven Centeral\u003c/a\u003e. Ideally if you are not an enterprise customer, you should be upgrading to\u0026nbsp;\u003ccode\u003e5.0.2\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003e5.1.1\u003c/code\u003e\u0026nbsp;which are the current supported open source releases."
                }
              ],
              "value": "When configuring SSL bundles in Spring Cloud Gateway by using the configuration property\u00a0spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead.\nNote: The\u00a04.2.x\u00a0branch is no longer under open source support. If you are using Spring Cloud Gateway\u00a04.2.0\u00a0and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway\u00a04.2.x\u00a0release newer than\u00a04.2.0\u00a0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to\u00a05.0.2\u00a0or\u00a05.1.1\u00a0which are the current supported open source releases."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-10T07:32:31.260Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-22750"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "SSL bundle configuration silently bypassed in Spring Cloud Gateway",
          "x_generator": {
            "engine": "Vulnogram 1.0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-22750",
        "datePublished": "2026-04-10T07:32:31.260Z",
        "dateReserved": "2026-01-09T06:55:03.990Z",
        "dateUpdated": "2026-04-10T12:59:14.451Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0417

Vulnerability from certfr_avis - Published: 2026-04-10 - Updated: 2026-04-10

Une vulnérabilité a été découverte dans Spring Cloud Gateway. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Spring	N/A	Cloud Gateway versions 4.2.x antérieures à 4.2.1

References

Title

Publication Time

FKIE_CVE-2026-22750

Vulnerability from fkie_nvd - Published: 2026-04-10 08:16 - Updated: 2026-10-26 22:10

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security@vmware.com	https://spring.io/security/cve-2026-22750	Vendor Advisory

Impacted products

	Vendor	Product	Version
	vmware	spring_cloud_gateway	4.2.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Spring Cloud Gateway",
          "product": "Spring Cloud Gateway",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "4.2.1",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "ENTERPRISE"
            }
          ]
        }
      ],
      "source": "security@vmware.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_gateway:4.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FC64DD6-416A-4D8E-B08B-376C318F4849",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When configuring SSL bundles in Spring Cloud Gateway by using the configuration property\u00a0spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead.\nNote: The\u00a04.2.x\u00a0branch is no longer under open source support. If you are using Spring Cloud Gateway\u00a04.2.0\u00a0and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway\u00a04.2.x\u00a0release newer than\u00a04.2.0\u00a0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to\u00a05.0.2\u00a0or\u00a05.1.1\u00a0which are the current supported open source releases."
    },
    {
      "lang": "es",
      "value": "Al configurar paquetes SSL en Spring Cloud Gateway utilizando la propiedad de configuraci\u00f3n spring.ssl.bundle, la configuraci\u00f3n fue ignorada silenciosamente y se utiliz\u00f3 la configuraci\u00f3n SSL predeterminada en su lugar.\nNota: La rama 4.2.x ya no cuenta con soporte de c\u00f3digo abierto. Si est\u00e1 utilizando Spring Cloud Gateway 4.2.0 y no es un cliente empresarial, puede actualizar a cualquier versi\u00f3n de Spring Cloud Gateway 4.2.x posterior a 4.2.0 disponible en Maven Central https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/. Idealmente, si no es un cliente empresarial, deber\u00eda actualizar a 5.0.2 o 5.1.1, que son las versiones de c\u00f3digo abierto actualmente soportadas."
    }
  ],
  "id": "CVE-2026-22750",
  "lastModified": "2026-10-26T22:10:00.163",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security@vmware.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22750",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-10T12:59:10.606788Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-10T08:16:24.787",
  "references": [
    {
      "source": "security@vmware.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://spring.io/security/cve-2026-22750"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-15"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-HWQH-2684-54FC

Vulnerability from github – Published: 2026-04-10 09:31 – Updated: 2026-04-14 18:27

Summary

Spring Cloud Gateway's SSL bundle configuration silently bypassed

Details

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead.

Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally, if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1, which are the current supported open source releases.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.cloud:spring-cloud-gateway"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "4.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-22750"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-15"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-10T22:11:21Z",
    "nvd_published_at": "2026-04-10T08:16:24Z",
    "severity": "HIGH"
  },
  "details": "When configuring SSL bundles in Spring Cloud Gateway by using the configuration property\u00a0spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead.\n\nNote: The\u00a04.2.x\u00a0branch is no longer under open source support. If you are using Spring Cloud Gateway\u00a04.2.0\u00a0and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway\u00a04.2.x\u00a0release newer than\u00a04.2.0\u00a0available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally, if you are not an enterprise customer, you should be upgrading to\u00a05.0.2\u00a0or\u00a05.1.1,\u00a0which are the current supported open source releases.",
  "id": "GHSA-hwqh-2684-54fc",
  "modified": "2026-04-14T18:27:12Z",
  "published": "2026-04-10T09:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22750"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spring-cloud/spring-cloud-gateway/pull/3641"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spring-cloud/spring-cloud-gateway/commit/84009f2ee421e2191f8cc32ce3a84e7fc09e305e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spring-cloud/spring-cloud-gateway"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spring-cloud/spring-cloud-gateway/releases/tag/v4.2.1"
    },
    {
      "type": "WEB",
      "url": "https://spring.io/security/cve-2026-22750"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spring Cloud Gateway\u0027s SSL bundle configuration silently bypassed"
}

WID-SEC-W-2026-1041

Vulnerability from csaf_certbund - Published: 2026-04-09 22:00 - Updated: 2026-04-12 22:00

Summary

VMware Tanzu Spring Cloud Gateway: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Severity

Mittel

Scope

1 vulnerability in this advisory, including CVE-2026-22750.

CVE-2026-22750

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-22750 (GCVE-0-2026-22750)

CERTFR-2026-AVI-0417

Solutions

FKIE_CVE-2026-22750

GHSA-HWQH-2684-54FC

WID-SEC-W-2026-1041

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour