The vulnerability causes Spring Cloud Gateway to ignore the user‑supplied SSL bundle configured through spring.ssl.bundle and default to the platform’s built‑in SSL settings. As a result, connections may be established with unintended certificates or weaker encryption, allowing attackers to eavesdrop, tamper with or downgrade secure traffic. The flaw reflects a configuration control weakness classified as CWE‑15.

VMware’s Spring Cloud Gateway is affected. The issue targets the 4.2.0 release and any older 4.2.x versions that have not been updated in that branch. The 4.2.x branch no longer receives open‑source support. The current open‑source supported releases 5.0.2 and 5.1.1 are not affected.

The advisory lists a CVSS score of 7.5, indicating a moderate‑to‑high severity. Its EPSS score is below 1% and it is not included in CISA's KEV catalog, implying a relatively low likelihood of known exploitation. The vulnerability can be leveraged by an attacker who can alter the gateway’s deployment configuration—for example, by compromising configuration files or the systems that inject them—thereby triggering the fallback to default SSL. Restricting configuration access and verifying the applied bundle mitigate the risk.