GitHub Advisoryadvisory · Maven

GHSA-4q2v-9p7v-3v22 Reactor Netty HTTP is vulnerable to credential leaks during chained redirects

MEDIUM Published 2025-07-16 Modified 2025-07-16 Official page ↗
Aliases
CVE-2025-22227
Ecosystem
Maven
Packages
io.projectreactor.netty:reactor-netty-http
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-200
Reviewed
2025-07-16

Affected packages

• Maven io.projectreactor.netty:reactor-netty-http: >= 1.3.0-M1, < 1.3.0-M5 → fixed in 1.3.0-M5 • Maven io.projectreactor.netty:reactor-netty-http: < 1.2.8 → fixed in 1.2.8

Description

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

Related

Alias · CVE (1)

  • CVE-2025-22227 In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References