CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client (VMware Reactor Netty)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.40 % · percentile 35 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- vmware
- NVD status
- Deferred
Description
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | vmware |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · security@vmware.com (Secondary) |
Advisories
- GHSA-4q2v-9p7v-3v22 — Reactor Netty HTTP is vulnerable to credential leaks during chained redirects
European references
- ENISA EUVD · EUVD-2025-21595
- GCVE · GCVE-0-2025-22227
CERT-FR advisories
- CERTFR-2026-AVI-0641 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0500 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1131 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0935 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| VMware · Reactor Netty | affected 1.0.x < 1.0.49 (Reactor BOM 2020.0.48) ; affected 1.1.x < 1.1.32 (Reactor BOM 2022.0.27 and 2023.0.20) ; affected 1.2.x < 1.2.8 (Reactor BOM 2024.0.8) ; affected 1.3.x < 1.3.0-M5 (Reactor BOM 2025.0.0-M5) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |