CVE-2025-22227 — CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client

CVE-2025-22227

CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client PUBLISHED

Description (CNA)

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

Affected (CNA)

Vendor / product	Versions
VMware / Reactor Netty	affected 1.0.x before 1.0.49 (Reactor BOM 2020.0.48); affected 1.1.x before 1.1.32 (Reactor BOM 2022.0.27 and 2023.0.20); affected 1.2.x before 1.2.8 (Reactor BOM 2024.0.8); affected 1.3.x before 1.3.0-M5 (Reactor BOM 2025.0.0-M5)

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2025-22227

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.