GHSA-pfc9-2cqg-9wq6
Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect
Quick fix
GHSA-pfc9-2cqg-9wq6 — io.projectreactor.netty:reactor-netty: upgrade to the fixed version with the command below.
# pom.xml: bump <version>1.3.6</version> for io.projectreactor.netty:reactor-nettyDetails
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.
Are you affected?
Enter the version of the package you're using.
Affected packages
1.3.0 Fixed in: 1.3.6 # pom.xml: bump <version>1.3.6</version> for io.projectreactor.netty:reactor-netty 1.2.0 Fixed in: 1.2.18 # pom.xml: bump <version>1.2.18</version> for io.projectreactor.netty:reactor-netty 1.1.0 No fixed version published yet for io.projectreactor.netty:reactor-netty (maven). Pin to a known-safe version or switch to an alternative.
1.0.0 No fixed version published yet for io.projectreactor.netty:reactor-netty (maven). Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-41715 [ADVISORY]
- https://github.com/reactor/reactor-netty/commit/e7ef551eead84ba465324531683fafa03ab96ee9 [WEB]
- https://github.com/reactor/reactor-netty [PACKAGE]
- https://github.com/reactor/reactor-netty/releases/tag/v1.2.18 [WEB]
- https://github.com/reactor/reactor-netty/releases/tag/v1.3.6 [WEB]
- https://spring.io/security/cve-2026-41715 [WEB]