MEDIUM6.1

GHSA-4q2v-9p7v-3v22

Reactor Netty HTTP is vulnerable to credential leaks during chained redirects

Quick fix

GHSA-4q2v-9p7v-3v22 — io.projectreactor.netty:reactor-netty-http: upgrade to the fixed version with the command below.

# pom.xml: bump <version>1.3.0-M5</version> for io.projectreactor.netty:reactor-netty-http

Details

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/io.projectreactor.netty:reactor-netty-http

Introduced in: 1.3.0-M1Fixed in: 1.3.0-M5

Fix# pom.xml: bump <version>1.3.0-M5</version> for io.projectreactor.netty:reactor-netty-http

Maven/io.projectreactor.netty:reactor-netty-http

Introduced in: 0Fixed in: 1.2.8

Fix# pom.xml: bump <version>1.2.8</version> for io.projectreactor.netty:reactor-netty-http

References

https://nvd.nist.gov/vuln/detail/CVE-2025-22227[ADVISORY]
https://github.com/reactor/reactor-netty/commit/522892307ea89bf24fe634e8bfea35728c9bf411[WEB]
https://github.com/reactor/reactor-netty[PACKAGE]
https://spring.io/security/cve-2025-22227[WEB]