CVE-2020-5404: Insufficiently Protected Credentials in Reactor Netty
Summary
CVE-2020-5404: Insufficiently Protected Credentials in Reactor Netty. Affects io.projectreactor.netty:reactor-netty-http across 2 version ranges.
>= 0.8.0, < 0.8.16
>= 0.9.0, < 0.9.5
Fixed in 0.8.16 or 0.9.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Reactor Netty is a library that provides an asynchronous event-driven network application framework for building reactive applications on the JVM. It is commonly used for creating high-performance, non-blocking HTTP clients and servers. The affected package, io.projectreactor.netty:reactor-netty-http, is a component of Reactor Netty that handles HTTP requests and responses. This vulnerability exists in versions 0.9.x prior to 0.9.5 and versions 0.8.x prior to 0.8.16 of the package.
Vulnerability Detail
The vulnerability, identified as CVE-2020-5404, is an insufficiently protected credentials issue in Reactor Netty's HttpClient. When the HttpClient is explicitly configured to follow redirects, it may be used incorrectly, resulting in a credentials leak during a redirect to a different domain. This means that if an application using Reactor Netty's HttpClient is vulnerable and redirects occur during HTTP requests, sensitive credentials could be exposed to an unintended domain. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.9.
How To Fix
Latest published version: 1.4.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.8.0, < 0.8.160.8.16 -
>= 0.9.0, < 0.9.50.9.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can mitigate the risk by avoiding explicit configurations to follow redirects in the HttpClient. By not enabling redirect handling, the credentials leak can be prevented. It is important to note that this workaround may impact the functionality of the application, especially if redirects are necessary for its intended behavior.
Conclusion
In conclusion, the vulnerability CVE-2020-5404 in Reactor Netty's HttpClient can result in a credentials leak during redirects to different domains. It is crucial for developers to upgrade to the fixed versions of the affected package (0.9.5 or 0.8.16) to prevent this vulnerability. Additionally, avoiding explicit configurations for redirect handling can mitigate the risk. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for io.projectreactor.netty:reactor-netty-http →
FAQ
Reactor Netty is a library for building reactive network applications on the JVM. It provides an event-driven, non-blocking framework for creating high-performance HTTP clients and servers.
The affected package is io.projectreactor.netty:reactor-netty-http, which is a component of Reactor Netty responsible for handling HTTP requests and responses.
The vulnerability can lead to a credentials leak during redirects to different domains. This means that sensitive credentials could be exposed to unintended domains, potentially leading to unauthorized access or misuse.
To fix this vulnerability, it is recommended to upgrade the affected package to the fixed versions: 0.9.5 for versions 0.9.x and 0.8.16 for versions 0.8.x. Updating the package ensures that the HttpClient handles redirects correctly and prevents the credentials leak.
While there is no specific workaround provided, developers can mitigate the risk by avoiding explicit configurations to follow redirects in the HttpClient. By not enabling redirect handling, the credentials leak can be prevented. However, this may impact the functionality of the application if redirects are necessary.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.projectreactor.netty:reactor-netty-http.
