7.7
High
CVE-2026-47879 Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto…
Description
Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Cloud Gateway 5.0 | 5.0.0 → 5.0.2 | No fix stated |
| Spring Cloud Gateway 4.3 | 4.3.0 → 4.3.5 | No fix stated |
| Spring Cloud Gateway 4.0 | 4.0.0 → 4.2.9 | No fix stated |
| Spring Cloud Gateway 3.1 | earliest → 3.1.13 | No fix stated |