PT-2026-47647 · Spring · Reactor Netty

Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-41715

NVD

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2026-41715

Affected Products

Reactor Netty

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-41715 · Security Note
• https://spring.io/security/cve-2026-41715 · Note