Credential Leak Vulnerability in Reactor Netty HTTP Client by Pivotal Software
CVE-2025-22227

6.1MEDIUM

Key Information:

Vendor

Vmware
Status
Reactor Netty
Vendor
CVE Published:
16 July 2025

What is CVE-2025-22227?

The Reactor Netty HTTP client may inadvertently expose authentication credentials during chained redirect scenarios. This issue arises when the client is explicitly set to follow redirects, which can lead to sensitive information being leaked to unintended recipients. Proper configuration and an understanding of the redirect handling process are essential to mitigate the risks associated with this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Reactor Netty 1.0.x < 1.0.49 (Reactor BOM 2020.0.48)

Reactor Netty 1.1.x < 1.1.32 (Reactor BOM 2022.0.27 and 2023.0.20)

Reactor Netty 1.2.x < 1.2.8 (Reactor BOM 2024.0.8)

References

https://spring.io/security/cve-2025-22227

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.