CVE-2026-41715
Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.
- Record
CVE-2026-41715- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
EUVDEUVD-2026-35322
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.
- Record
EUVD-2026-35322- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pfc9-2cqg-9wq6
Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.
- Record
GHSA-pfc9-2cqg-9wq6- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
NVD
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.
- Record
CVE-2026-41715- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
OSVGHSA-pfc9-2cqg-9wq6
Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.
- Record
GHSA-pfc9-2cqg-9wq6- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
OSVCLSA-2026-1777941833 No score
TuxCare security update for org.springframework.pulsar (2 CVEs)
TuxCare rebuilt 6 org.springframework.pulsar packages to address 2 CVEs. Fixed in 1.1.13-tuxcare.1.
- Record
CLSA-2026-1777941833- Updated
- 2026-11-02
Show 12 moreShow less
OSVCLSA-2026-1783645392 No score
TuxCare security update for io.projectreactor.netty (1 CVE)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 1 CVE. Fixed in 1.0.39-tuxcare.2.
- Record
CLSA-2026-1783645392- Updated
- 2026-11-02
OSVCLSA-2026-1783645399 No score
TuxCare security update for io.projectreactor.netty (1 CVE)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 1 CVE. Fixed in 1.0.32-tuxcare.3.
- Record
CLSA-2026-1783645399- Updated
- 2026-11-02
OSVCLSA-2026-1784769563 No score
TuxCare security update for io.projectreactor.netty (1 CVE)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 1 CVE. Fixed in 1.0.7-tuxcare.2.
- Record
CLSA-2026-1784769563- Updated
- 2026-11-02
OSVCLSA-2026-1786940280 No score
TuxCare security update for io.projectreactor.netty (1 CVE)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 1 CVE. Fixed in 1.0.48-tuxcare.1.
- Record
CLSA-2026-1786940280- Updated
- 2026-11-02
OSVCLSA-2026-1787292931 No score
TuxCare security update for io.projectreactor.netty (2 CVEs)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 2 CVEs. Fixed in 1.1.31-tuxcare.1.
- Record
CLSA-2026-1787292931- Updated
- 2026-11-02
OSVCLSA-2026-1788337769 No score
TuxCare security update for io.projectreactor.netty (2 CVEs)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 2 CVEs. Fixed in 1.1.13-tuxcare.1.
- Record
CLSA-2026-1788337769- Updated
- 2026-11-02
OSVCLSA-2026-1788524080 No score
TuxCare security update for io.projectreactor.netty (1 CVE)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 1 CVE. Fixed in 1.1.15-tuxcare.2.
- Record
CLSA-2026-1788524080- Updated
- 2026-11-02
OSVCLSA-2026-1789459160 No score
TuxCare security update for io.projectreactor.netty (1 CVE)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 1 CVE. Fixed in 1.2.13-tuxcare.1.
- Record
CLSA-2026-1789459160- Updated
- 2026-11-02
OSVCLSA-2026-1792575065 No score
TuxCare security update for io.projectreactor.netty (1 CVE)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 1 CVE. Fixed in 1.0.23-tuxcare.2.
- Record
CLSA-2026-1792575065- Updated
- 2026-11-02
OSVCLSA-2026-1793345120 No score
TuxCare security update for io.projectreactor.netty (8 CVEs)
TuxCare rebuilt 4 io.projectreactor.netty packages to address 8 CVEs. Fixed in 1.0.34-tuxcare.1.
- Record
CLSA-2026-1793345120- Updated
- 2026-11-02
OSVCLSA-2026-1793619094 No score
TuxCare security update for io.projectreactor.netty (4 CVEs)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 4 CVEs. Fixed in 1.0.18-tuxcare.1.
- Record
CLSA-2026-1793619094- Updated
- 2026-11-02
OSVCLSA-2026-1794232618 No score
TuxCare security update for io.projectreactor.netty (3 CVEs)
TuxCare rebuilt 2 io.projectreactor.netty packages to address 3 CVEs. Fixed in 1.0.17-tuxcare.2.
- Record
CLSA-2026-1794232618- Updated
- 2026-11-09
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.projectreactor.netty:reactor-nettyMaven |
1.3.0 to 1.3.5 | 1.3.6 |
io.projectreactor.netty:reactor-nettyMaven |
1.2.0 to 1.2.17 | 1.2.18 |
io.projectreactor.netty:reactor-nettyMaven |
1.1.0 to 1.1.31 | None known |
io.projectreactor.netty:reactor-nettyMaven |
1.0.0 to 1.0.48 | None known |
io.projectreactor.netty:reactor-nettyTuxCare:Maven |
1.0.39 up to 1.0.39-tuxcare.2, plus listed versions 1.0.39-tuxcare.1 |
1.0.39-tuxcare.2 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven |
1.0.39 up to 1.0.39-tuxcare.2, plus listed versions 1.0.39-tuxcare.1 |
1.0.39-tuxcare.2 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven |
1.0.32 up to 1.0.32-tuxcare.3, plus listed versions 1.0.32-tuxcare.11.0.32-tuxcare.2 |
1.0.32-tuxcare.3 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven |
1.0.32 up to 1.0.32-tuxcare.3, plus listed versions 1.0.32-tuxcare.11.0.32-tuxcare.2 |
1.0.32-tuxcare.3 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven |
1.0.7 up to 1.0.7-tuxcare.2, plus listed versions 1.0.7-tuxcare.1 |
1.0.7-tuxcare.2 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven |
1.0.7 up to 1.0.7-tuxcare.2, plus listed versions 1.0.7-tuxcare.1 |
1.0.7-tuxcare.2 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
io.projectreactor.netty:reactor-nettyTuxCare:Maven |
1.0.48 up to 1.0.48-tuxcare.1 | 1.0.48-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven |
1.0.48 up to 1.0.48-tuxcare.1 | 1.0.48-tuxcare.1 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven From an advisory covering 2 CVEs |
1.1.31 up to 1.1.31-tuxcare.1 | 1.1.31-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 2 CVEs |
1.1.31 up to 1.1.31-tuxcare.1 | 1.1.31-tuxcare.1 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven From an advisory covering 2 CVEs |
1.1.13 up to 1.1.13-tuxcare.1 | 1.1.13-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 2 CVEs |
1.1.13 up to 1.1.13-tuxcare.1 | 1.1.13-tuxcare.1 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven |
1.1.15 up to 1.1.15-tuxcare.2, plus listed versions 1.1.15-tuxcare.1 |
1.1.15-tuxcare.2 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven |
1.1.15 up to 1.1.15-tuxcare.2, plus listed versions 1.1.15-tuxcare.1 |
1.1.15-tuxcare.2 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven |
1.2.13 up to 1.2.13-tuxcare.1 | 1.2.13-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven |
1.2.13 up to 1.2.13-tuxcare.1 | 1.2.13-tuxcare.1 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven |
1.0.23 up to 1.0.23-tuxcare.2, plus listed versions 1.0.23-tuxcare.1 |
1.0.23-tuxcare.2 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven |
1.0.23 up to 1.0.23-tuxcare.2, plus listed versions 1.0.23-tuxcare.1 |
1.0.23-tuxcare.2 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven From an advisory covering 8 CVEs |
1.0.34 up to 1.0.34-tuxcare.1 | 1.0.34-tuxcare.1 |
io.projectreactor.netty:reactor-netty-coreTuxCare:Maven From an advisory covering 8 CVEs |
1.0.34 up to 1.0.34-tuxcare.1 | 1.0.34-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 8 CVEs |
1.0.34 up to 1.0.34-tuxcare.1 | 1.0.34-tuxcare.1 |
io.projectreactor.netty:reactor-netty-http-braveTuxCare:Maven From an advisory covering 8 CVEs |
1.0.34 up to 1.0.34-tuxcare.1 | 1.0.34-tuxcare.1 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven From an advisory covering 4 CVEs |
1.0.18 up to 1.0.18-tuxcare.1 | 1.0.18-tuxcare.1 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 4 CVEs |
1.0.18 up to 1.0.18-tuxcare.1 | 1.0.18-tuxcare.1 |
io.projectreactor.netty:reactor-nettyTuxCare:Maven From an advisory covering 3 CVEs |
1.0.17 up to 1.0.17-tuxcare.2, plus listed versions 1.0.17-tuxcare.1 |
1.0.17-tuxcare.2 |
io.projectreactor.netty:reactor-netty-httpTuxCare:Maven From an advisory covering 3 CVEs |
1.0.17 up to 1.0.17-tuxcare.2, plus listed versions 1.0.17-tuxcare.1 |
1.0.17-tuxcare.2 |
io.projectreactor.netty:reactor-nettyMaven |
1.3.0 up to 1.3.6, plus listed versions 1.3.11.3.21.3.31.3.41.3.5 |
1.3.6 |
io.projectreactor.netty:reactor-nettyMaven |
1.2.0 up to 1.2.18, plus listed versions 1.2.11.2.101.2.111.2.121.2.13 Show 12 moreShow less1.2.141.2.151.2.161.2.171.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.9 |
1.2.18 |
io.projectreactor.netty:reactor-nettyMaven |
1.1.0 to 1.1.31, plus listed versions 1.1.11.1.101.1.111.1.121.1.13 Show 25 moreShow less1.1.141.1.151.1.161.1.171.1.181.1.191.1.21.1.201.1.211.1.221.1.231.1.241.1.251.1.261.1.271.1.281.1.291.1.31.1.301.1.41.1.51.1.61.1.71.1.81.1.9 |
None known |
io.projectreactor.netty:reactor-nettyMaven |
1.0.0 to 1.0.48, plus listed versions 1.0.11.0.101.0.111.0.121.0.13 Show 42 moreShow less1.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.201.0.211.0.221.0.231.0.241.0.251.0.261.0.271.0.281.0.291.0.31.0.301.0.311.0.321.0.331.0.341.0.351.0.361.0.371.0.381.0.391.0.41.0.401.0.411.0.421.0.431.0.441.0.451.0.461.0.471.0.51.0.61.0.71.0.81.0.9 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, facts | ||
| affected | ||
| affected, aliases | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41715 is a medium vulnerability (CVSS 6.1) in Spring Reactor Netty, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in io.projectreactor.netty:reactor-netty 1.3.6.
References
spring.io/security/cve-2026-41715
nvd.nist.gov/vuln/detail/CVE-2026-41715
github.com/reactor/reactor-netty/commit/e7ef551eead84ba465324531683fafa03ab96ee9