Vulnerability-Lookup

WID-SEC-W-2026-1901

Vulnerability from csaf_certbund - Published: 2026-06-11 22:00 - Updated: 2026-06-15 22:00

Summary

VMware Tanzu Spring Cloud Gateway Server und Sleuth: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: VMware Tanzu Spring Cloud ist eine Plattform zur Bereitstellung und Verwaltung von Spring-Anwendungen in Cloud-Umgebungen unter Verwendung von Microservices-Architekturen.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Cloud Gateway Server und Sleuth ausnutzen, um einen Denial of Service Angriff durchzuführen oder um Daten zu manipulieren.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2026-41708

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
VMware Tanzu Spring Cloud Sleuth <3.1.14 VMware Tanzu / Spring Cloud		Sleuth <3.1.14

CVE-2026-47825

Affected products

Known affected 6 products

Product	Identifier	Version	Remediation
VMware Tanzu Spring Cloud Gateway Server <4.2.9 VMware Tanzu / Spring Cloud		Gateway Server <4.2.9
VMware Tanzu Spring Cloud Gateway Server <3.1.13 VMware Tanzu / Spring Cloud		Gateway Server <3.1.13
VMware Tanzu Spring Cloud Gateway Server <5.0.2 VMware Tanzu / Spring Cloud		Gateway Server <5.0.2
VMware Tanzu Spring Cloud Gateway Server <5.0.1.1 VMware Tanzu / Spring Cloud		Gateway Server <5.0.1.1
VMware Tanzu Spring Cloud Gateway Server <4.3.5 VMware Tanzu / Spring Cloud		Gateway Server <4.3.5
VMware Tanzu Spring Cloud Gateway Server <4.3.4.1 VMware Tanzu / Spring Cloud		Gateway Server <4.3.4.1

References

4 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://spring.io/security/cve-2026-41708	external
https://spring.io/security/cve-2026-47825	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "VMware Tanzu Spring Cloud ist eine Plattform zur Bereitstellung und Verwaltung von Spring-Anwendungen in Cloud-Umgebungen unter Verwendung von Microservices-Architekturen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Cloud Gateway Server und Sleuth ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren oder um Daten zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1901 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1901.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1901 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1901"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-41708 vom 2026-06-11",
        "url": "https://spring.io/security/cve-2026-41708"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-47825 vom 2026-06-11",
        "url": "https://spring.io/security/cve-2026-47825"
      }
    ],
    "source_lang": "en-US",
    "title": "VMware Tanzu Spring Cloud Gateway Server und Sleuth: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-06-15T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-16T08:20:07.011+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1901",
      "initial_release_date": "2026-06-11T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-11T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-15T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-36797, EUVD-2026-37000"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Sleuth \u003c3.1.14",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Sleuth \u003c3.1.14",
                  "product_id": "T055320"
                }
              },
              {
                "category": "product_version",
                "name": "Sleuth 3.1.14",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Sleuth 3.1.14",
                  "product_id": "T055320-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_cloud:sleuth__3.1.14"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Gateway Server \u003c3.1.13",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Gateway Server \u003c3.1.13",
                  "product_id": "T055321"
                }
              },
              {
                "category": "product_version",
                "name": "Gateway Server 3.1.13",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Gateway Server 3.1.13",
                  "product_id": "T055321-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_cloud:gateway_server__3.1.13"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Gateway Server \u003c4.2.9",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Gateway Server \u003c4.2.9",
                  "product_id": "T055322"
                }
              },
              {
                "category": "product_version",
                "name": "Gateway Server 4.2.9",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Gateway Server 4.2.9",
                  "product_id": "T055322-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_cloud:gateway_server__4.2.9"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Gateway Server \u003c4.3.4.1",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Gateway Server \u003c4.3.4.1",
                  "product_id": "T055323"
                }
              },
              {
                "category": "product_version",
                "name": "Gateway Server 4.3.4.1",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Gateway Server 4.3.4.1",
                  "product_id": "T055323-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_cloud:gateway_server__4.3.4.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Gateway Server \u003c4.3.5",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Gateway Server \u003c4.3.5",
                  "product_id": "T055324"
                }
              },
              {
                "category": "product_version",
                "name": "Gateway Server 4.3.5",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Gateway Server 4.3.5",
                  "product_id": "T055324-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_cloud:gateway_server__4.3.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Gateway Server \u003c5.0.1.1",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Gateway Server \u003c5.0.1.1",
                  "product_id": "T055325"
                }
              },
              {
                "category": "product_version",
                "name": "Gateway Server 5.0.1.1",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Gateway Server 5.0.1.1",
                  "product_id": "T055325-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_cloud:gateway_server__5.0.1.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Gateway Server \u003c5.0.2",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Gateway Server \u003c5.0.2",
                  "product_id": "T055326"
                }
              },
              {
                "category": "product_version",
                "name": "Gateway Server 5.0.2",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Gateway Server 5.0.2",
                  "product_id": "T055326-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_cloud:gateway_server__5.0.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spring Cloud"
          }
        ],
        "category": "vendor",
        "name": "VMware Tanzu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-41708",
      "product_status": {
        "known_affected": [
          "T055320"
        ]
      },
      "release_date": "2026-06-11T22:00:00.000+00:00",
      "title": "CVE-2026-41708"
    },
    {
      "cve": "CVE-2026-47825",
      "product_status": {
        "known_affected": [
          "T055322",
          "T055321",
          "T055326",
          "T055325",
          "T055324",
          "T055323"
        ]
      },
      "release_date": "2026-06-11T22:00:00.000+00:00",
      "title": "CVE-2026-47825"
    }
  ]
}

CVE-2026-41708 (GCVE-0-2026-41708)

Vulnerability from cvelistv5 – Published: 2026-06-15 18:54 – Updated: 2026-06-15 20:06

Title

Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

Summary

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled. Affected versions: Spring Cloud Sleuth 3.1.0 through 3.1.13.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

vmware

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-41708

Impacted products

1 product

Vendor	Product	Version
Spring	Spring Cloud Sleuth	Affected: 3.1.0 , < 3.1.14 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41708",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T20:06:15.787096Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-15T20:06:25.691Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Sleuth",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "3.1.14",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled.\n\nAffected versions:\nSpring Cloud Sleuth 3.1.0 through 3.1.13."
            }
          ],
          "value": "In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled.\n\nAffected versions:\nSpring Cloud Sleuth 3.1.0 through 3.1.13."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Per CVSS v3.1: Availability HIGH."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-15T18:54:42.292Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41708"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41708",
    "datePublished": "2026-06-15T18:54:42.292Z",
    "dateReserved": "2026-04-22T06:21:34.490Z",
    "dateUpdated": "2026-06-15T20:06:25.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47825 (GCVE-0-2026-47825)

Vulnerability from cvelistv5 – Published: 2026-06-15 19:34 – Updated: 2026-06-16 14:15

Title

Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations

Summary

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-346 - Origin Validation Error

Assigner

vmware

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-47825

Impacted products

1 product

Vendor	Product	Version
Spring	Spring Cloud Gateway	Affected: 3.1.0 , < 3.1.13 (custom) Affected: 4.1.0 , < 4.1.13 (custom) Affected: 4.2.0 , < 4.2.9 (custom) Affected: 4.3.0 , < 4.3.5 (custom) Affected: 5.0.0 , < 5.0.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47825",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T14:15:33.149410Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T14:15:41.222Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Gateway",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "3.1.13",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.13",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.9",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.5",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.0.2",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.\n\nAffected versions:\nSpring Cloud Gateway 3.1.x (fix 3.1.13).\nSpring Cloud Gateway 4.1.x (fix 4.1.13).\nSpring Cloud Gateway 4.2.x (fix 4.2.9).\nSpring Cloud Gateway 4.3.x (fix 4.3.5).\nSpring Cloud Gateway 5.0.x (fix 5.0.2)."
            }
          ],
          "value": "Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.\n\nAffected versions:\nSpring Cloud Gateway 3.1.x (fix 3.1.13).\nSpring Cloud Gateway 4.1.x (fix 4.1.13).\nSpring Cloud Gateway 4.2.x (fix 4.2.9).\nSpring Cloud Gateway 4.3.x (fix 4.3.5).\nSpring Cloud Gateway 5.0.x (fix 5.0.2)."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Per CVSS v3.1: Integrity HIGH (header spoofing from untrusted proxy sources)."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-15T19:34:29.601Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-47825"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-47825",
    "datePublished": "2026-06-15T19:34:29.601Z",
    "dateReserved": "2026-05-20T10:00:48.930Z",
    "dateUpdated": "2026-06-16T14:15:41.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2026-1901

CVE-2026-41708 (GCVE-0-2026-41708)

CVE-2026-47825 (GCVE-0-2026-47825)

Tags

Sightings

Nomenclature