CVE-2025-22227
CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
- Record
CVE-2025-22227- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2025-21595
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
- Record
EUVD-2025-21595- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4q2v-9p7v-3v22
Reactor Netty HTTP is vulnerable to credential leaks during chained redirects
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
- Record
GHSA-4q2v-9p7v-3v22- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
- Record
CVE-2025-22227- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-4q2v-9p7v-3v22
Reactor Netty HTTP is vulnerable to credential leaks during chained redirects
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
- Record
GHSA-4q2v-9p7v-3v22- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-22227
CVE-2025-22227 in io.root.io.projectreactor.netty:reactor-netty-http - Patched by Root
Root has patched CVE-2025-22227 in the io.root.io.projectreactor.netty:reactor-netty-http package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2025-22227- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 9 moreShow less
OSVCLSA-2025-1763424415 No score
TuxCare security update for io.projectreactor.netty:reactor-netty-http (1 CVE)
TuxCare rebuilt io.projectreactor.netty:reactor-netty-http to address 1 CVE. Fixed in 1.0.39-tuxcare.1.
- Record
CLSA-2025-1763424415- Updated
- 2026-11-02
OSVCLSA-2026-1768435721 No score
TuxCare security update for io.projectreactor.netty (4 CVEs)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 4 CVEs. Fixed in 1.0.23-tuxcare.1.
- Record
CLSA-2026-1768435721- Updated
- 2026-11-02
OSVCLSA-2026-1768781329 No score
TuxCare security update for io.projectreactor.netty:reactor-netty-http (1 CVE)
TuxCare rebuilt io.projectreactor.netty:reactor-netty-http to address 1 CVE. Fixed in 1.1.15-tuxcare.1.
- Record
CLSA-2026-1768781329- Updated
- 2026-11-02
OSVCLSA-2026-1775003155 No score
TuxCare security update for io.projectreactor.netty:reactor-netty-http (2 CVEs)
TuxCare rebuilt io.projectreactor.netty:reactor-netty-http to address 2 CVEs. Fixed in 1.0.0-tuxcare.1.
- Record
CLSA-2026-1775003155- Updated
- 2026-11-02
OSVCLSA-2026-1777941833 No score
TuxCare security update for org.springframework.pulsar (2 CVEs)
TuxCare rebuilt 6 org.springframework.pulsar packages to address 2 CVEs. Fixed in 1.1.13-tuxcare.1.
- Record
CLSA-2026-1777941833- Updated
- 2026-11-02
OSVCLSA-2026-1787292931 No score
TuxCare security update for io.projectreactor.netty (2 CVEs)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 2 CVEs. Fixed in 1.1.31-tuxcare.1.
- Record
CLSA-2026-1787292931- Updated
- 2026-11-02
OSVCLSA-2026-1787374807 No score
TuxCare security update for io.projectreactor.netty:reactor-netty-http (1 CVE)
TuxCare rebuilt io.projectreactor.netty:reactor-netty-http to address 1 CVE. Fixed in 1.0.48-tuxcare.3.
- Record
CLSA-2026-1787374807- Updated
- 2026-11-02
OSVCLSA-2026-1788337769 No score
TuxCare security update for io.projectreactor.netty (2 CVEs)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 2 CVEs. Fixed in 1.1.13-tuxcare.1.
- Record
CLSA-2026-1788337769- Updated
- 2026-11-02
OSVCLSA-2026-1793619094 No score
TuxCare security update for io.projectreactor.netty (4 CVEs)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 4 CVEs. Fixed in 1.0.18-tuxcare.1.
- Record
CLSA-2026-1793619094- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.projectreactor.netty:reactor-netty-httpMaven |
1.3.0-M1 up to 1.3.0-M5 | 1.3.0-M5 |
io.projectreactor.netty:reactor-netty-httpMaven |
before 1.2.8 | 1.2.8 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven |
1.0.39 up to 1.0.39-tuxcare.1 | 1.0.39-tuxcare.1 |
io.projectreactor.netty:reactor-netty-coreTuxCare:Maven From an advisory covering 4 CVEs |
1.0.23 up to 1.0.23-tuxcare.1 | 1.0.23-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 4 CVEs |
1.0.23 up to 1.0.23-tuxcare.1 | 1.0.23-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven |
1.1.15 up to 1.1.15-tuxcare.1 | 1.1.15-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 2 CVEs |
1.0.0 up to 1.0.0-tuxcare.1 | 1.0.0-tuxcare.1 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven From an advisory covering 2 CVEs |
1.1.31 up to 1.1.31-tuxcare.1 | 1.1.31-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 2 CVEs |
1.1.31 up to 1.1.31-tuxcare.1 | 1.1.31-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven |
1.0.48 up to 1.0.48-tuxcare.3, plus listed versions 1.0.48-tuxcare.11.0.48-tuxcare.2 |
1.0.48-tuxcare.3 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
io.projectreactor.netty:reactor-nettyTuxCare:Maven From an advisory covering 2 CVEs |
1.1.13 up to 1.1.13-tuxcare.1 | 1.1.13-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 2 CVEs |
1.1.13 up to 1.1.13-tuxcare.1 | 1.1.13-tuxcare.1 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven From an advisory covering 4 CVEs |
1.0.18 up to 1.0.18-tuxcare.1 | 1.0.18-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 4 CVEs |
1.0.18 up to 1.0.18-tuxcare.1 | 1.0.18-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpMaven |
1.3.0-M1 up to 1.3.0-M5, plus listed versions 1.3.0-M21.3.0-M31.3.0-M4 |
1.3.0-M5 |
io.projectreactor.netty:reactor-netty-httpMaven |
before 1.2.8, plus listed versions 1.0.01.0.11.0.101.0.111.0.12 Show 45 moreShow less1.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.201.0.211.0.221.0.231.0.241.0.251.0.261.0.271.0.281.0.291.0.31.0.301.0.311.0.321.0.331.0.341.0.351.0.361.0.371.0.381.0.391.0.41.0.401.0.411.0.421.0.431.0.441.0.451.0.461.0.471.0.481.0.51.0.61.0.71.0.81.0.91.1.0 |
1.2.8 |
io.root.io.projectreactor.netty:reactor-netty-httpRoot:Maven |
before 1.0.45-root.io.1 | 1.0.45-root.io.11.0.45-root.io.21.0.45-root.io.31.1.13-root.io.11.1.13-root.io.21.1.22-root.io.11.1.13-root.io.3 |
io.projectreactor.netty:reactor-netty-httpRoot:Maven |
before 1.0.45-aikido.3 | 1.0.45-aikido.31.1.22-aikido.11.1.13-aikido.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-22227 is a medium vulnerability (CVSS 6.1) in Vmware Reactor Netty, published July 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 35th percentile. Fixed in io.projectreactor.netty:reactor-netty-http 1.3.0-M5.
References
Left out here: 39 versions. The JSON record has them.