GHSA-pfc9-2cqg-9wq6
Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect
At a glance
- Published
- Updated
- CVE
- CVE-2026-41715
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.
Affected packages
| Package | Versions |
|---|---|
| Maven · io.projectreactor.netty:reactor-netty | introduced 1.3.0, fixed 1.3.6 |
| Maven · io.projectreactor.netty:reactor-netty | introduced 1.2.0, fixed 1.2.18 |
| Maven · io.projectreactor.netty:reactor-netty | introduced 1.1.0, last affected 1.1.31 |
| Maven · io.projectreactor.netty:reactor-netty | introduced 1.0.0, last affected 1.0.48 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-41715 ADVISORY
- https://github.com/reactor/reactor-netty/commit/e7ef551eead84ba465324531683fafa03ab96ee9 WEB
- https://github.com/reactor/reactor-netty PACKAGE
- https://github.com/reactor/reactor-netty/releases/tag/v1.2.18 WEB
- https://github.com/reactor/reactor-netty/releases/tag/v1.3.6 WEB
- https://spring.io/security/cve-2026-41715 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |