CVE-2025-22227: Reactor Netty HTTP Credential Leak Vulnerability During Chained Redirects
Summary
CVE-2025-22227: Reactor Netty HTTP is vulnerable to credential leaks during chained redirects. Affects io.projectreactor.netty:reactor-netty-http across 2 version ranges.
< 1.2.8
>= 1.3.0-M1, < 1.3.0-M5
Fixed in 1.2.8 or 1.3.0-M5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Reactor Netty HTTP is a reactive networking framework that provides an asynchronous and non-blocking way to handle HTTP requests and responses. It is widely used in Java applications for building efficient web services. The framework is designed to handle high concurrency and is built on top of the Netty framework, which is known for its performance and scalability. However, a vulnerability has been identified that can lead to credential leaks when the HTTP client is configured to follow chained redirects.
Vulnerability Detail
The vulnerability arises in specific scenarios where the Reactor Netty HTTP client is set to follow redirects. When multiple redirects occur, the client may inadvertently leak sensitive credentials, such as authentication tokens or cookies, to unintended destinations. This can happen if the redirect responses are not properly managed, allowing credentials to be sent to external sites. The potential ramifications include unauthorized access to user accounts and exposure of sensitive information, making it crucial for users of the affected versions to address this issue promptly.
How To Fix
Latest published version: 1.4.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.2.81.2.8 -
>= 1.3.0-M1, < 1.3.0-M51.3.0-M5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the automatic following of redirects in your HTTP client configuration. This can be done by setting the followRedirects option to false. For example:
HttpClient.create() .followRedirects(false);
This will prevent the client from automatically following redirects and leaking credentials.
Conclusion
In summary, the CVE-2025-22227 vulnerability in Reactor Netty HTTP poses a risk of credential leaks during chained redirects. Users are advised to update to the latest patched versions or implement workarounds to mitigate the risk. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for io.projectreactor.netty:reactor-netty-http →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate level of risk.
The affected versions are those prior to 1.3.0-M5 and 1.2.8.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without any signup.
The potential consequences include unauthorized access to user accounts and exposure of sensitive information, which can lead to data breaches.
Yes, you can prevent credential leaks by disabling automatic redirect following in your HTTP client configuration.
Related vulnerabilities
Recent vulnerabilities recorded for io.projectreactor.netty:reactor-netty-http.
