PT-2025-29713 · Eclipse Foundation · Reactor Netty

Martin Van Wingerden · Published 2025-07-16 · Updated 2025-09-22 · CVE-2025-22227

Positive Technologies · (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Reactor Netty HTTP client (affected versions not specified)

Description In specific scenarios involving chained redirects, the Reactor Netty HTTP client is susceptible to credential leakage. This issue occurs when the HTTP client is explicitly configured to follow redirects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-22227

GHSA-4Q2V-9P7V-3V22

Affected Products

Reactor Netty

References · 7

• https://osv.dev/vulnerability/GHSA-4q2v-9p7v-3v22 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22227 · Security Note
• https://github.com/reactor/reactor-netty/commit/522892307ea89bf24fe634e8bfea35728c9bf411 · Note
• https://github.com/reactor/reactor-netty · Note
• https://t.me/cvenotify/129122 · Telegram Post
• https://spring.io/security/cve-2025-22227 · Note
• https://twitter.com/CVEnew/status/1945435476460236866 · Twitter Post