~ / search / GHSA-pfc9-2cqg-9wq6

GHSA-pfc9-2cqg-9wq6

Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-41715

Packages

EcosystemPackageAffectedFixed in
Maven io.projectreactor.netty:reactor-netty >= 1.3.0, < 1.3.6 1.3.6
Maven io.projectreactor.netty:reactor-netty >= 1.2.0, < 1.2.18 1.2.18
Maven io.projectreactor.netty:reactor-netty >= 1.1.0, <= 1.1.31 no fix listed
Maven io.projectreactor.netty:reactor-netty >= 1.0.0, <= 1.0.48 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.

References

External links from the advisory. They lead to third-party sites.