What is CVE-2025-41253?

CVE-2025-41253 is a high-severity vulnerability in Vmware Spring Cloud Gateway Server Webflux, classified under Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection). CVSS score: 7.5/10. Published 2025-10-16.

How severe is CVE-2025-41253?

High severity. CVSS v3 base score is 7.5 out of 10.

RCE in Vmware Spring Cloud Gateway Server Webflux

CVE-2025-41253

The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers. An application should be considered vulnerable when all the following are t…

Vulnerability class: Log4Shell (CVE-2021-44228)

EPSS: 0.004 (34.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Vmware Spring Cloud Gateway Server Webflux — versions 3.1.x, 4.0.x, 4.1.x

Weakness classification (CWE)

CWE-917 — Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)

References

Frequently asked questions

What is CVE-2025-41253?: CVE-2025-41253 is a high-severity vulnerability in Vmware Spring Cloud Gateway Server Webflux, classified under Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection). CVSS score: 7.5/10. Published 2025-10-16.
How severe is CVE-2025-41253?: High severity. CVSS v3 base score is 7.5 out of 10.