Spring Cloud Gateway 3.0.x Release Notes

Bug Fixes

• Spring Cloud Gateway Server forwards X-Forwarded-* and Forwarded headers received from untrusted proxies under certain configurations. These headers are now removed by default unless a trusted-proxy filter is explicitly configured. If your application relies on these headers, configure trusted proxies after upgrading: spring.cloud.gateway.trusted-proxies=10\.0\.0\..* (CVE-2026-47825).

Dependency Upgrades

• Spring Cloud Build (NES) 3.0.5-spring-cloud-build-3.0.7
• Spring Cloud CircuitBreaker (NES) 2.0.3-spring-cloud-circuitbreaker-2.0.5
• Spring Cloud Commons (NES) 3.0.6-spring-cloud-commons-3.0.8

Bug Fixes

• This release patches the following:
  • Server forwards headers from untrusted proxies (CVE-2025-41235). X-Forwarded-* and Forwarded headers are disabled by default. If your application relies on these headers, you must configure trusted proxies after upgrading:
    • For Spring Cloud Gateway Server: spring.cloud.gateway.trusted-proxies=10\.0\.0\..*
    • For Spring Cloud Gateway Server MVC: spring.cloud.gateway.mvc.trusted-proxies=10\.0\.0\..*
  • Environment modification vulnerability (CVE-2025-41253).

Notes

• This release originates from the open‑source Spring Cloud Gateway repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Cloud Gateway 3.0.8.

Dependency Upgrades

• Spring Cloud Build (NES) 3.0.5-spring-cloud-build-3.0.6
• Spring Cloud CircuitBreaker (NES) 2.0.3-spring-cloud-circuitbreaker-2.0.4
• Spring Cloud Commons (NES) 3.0.6-spring-cloud-commons-3.0.7