CVE-2026-47879

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-47879

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47879.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-47879

Published

2026-08-27T05:20:24Z

Modified

2026-09-12T03:46:31Z

Severity

7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Spring Cloud Gateway SSRF and native file access with gRPC

Details

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier

Database specific

{
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47879.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "5.0.0"
                },
                {
                    "last_affected": "5.0.2"
                },
                {
                    "introduced": "4.3.0"
                },
                {
                    "last_affected": "4.3.5"
                },
                {
                    "introduced": "4.0.0"
                },
                {
                    "last_affected": "4.2.9"
                },
                {
                    "last_affected": "3.1.13"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/spring-cloud/spring-cloud-gateway

Affected ranges

Type

GIT

Repo

https://github.com/spring-cloud/spring-cloud-gateway

Events

Introduced

3e7edf0b19aa23b916eff5f2ca6594e373ff4715

Fixed

dd7de544068bf90d68f8f68f7220d65864ddf4dd

Database specific

Show details

{
    "cpe": "cpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v5.*

v5.0.0

v5.0.1

v5.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47879.json"