Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

spring-cloud/spring-cloud-gateway

              main @ 6606df9
            

Fixes

CVEs

HIGH

Peak severity

30.0%

Coverage

Highlights

Denial of Service: 7 prior fixes. Scrutinize any change in this area.

ModifyResponseBodyGatewayFilterFactory.java: most-fixed (2 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: Multiple fixes across different ProxyExchange implementations and argument resolvers address sensitive header leakage (cookie, authorization) and case-insensitive filtering. Inconsistent enforcement across variants is a recurring risk.

Denial of Service: Multiple fixes address memory leaks and connection leaks in response filters, request body caching, and retry logic. Resource exhaustion is a common DoS vector in a gateway.

Auth Bypass: SSL bundle loading condition bug could bypass client cert auth; empty rate limiter key allows unthrottled requests. Both are auth/authorization bypasses.