Reactor Netty HTTP is vulnerable to credential leaks during chained redirects

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-22227 · ADVISORY
• reactor/reactor-netty commit 5228923 · WEB
• reactor/reactor-netty · PACKAGE
• spring.io/security/cve-2025-22227 · WEB

Weitere Schwachstellen in io.projectreactor.netty:reactor-netty-http

• CVE-2023-34062HOCH 7.5In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a…
• CVE-2022-31684MITTEL 4.3Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers m…
• CVE-2020-5403HOCH 7.5Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely i…
• CVE-2020-5404MITTEL 5.9The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a …