{"id":"CVE-2025-22227","aliases":["CLSA-2025-1763424415","CLSA-2026-1768435721","CLSA-2026-1768781329","CLSA-2026-1775003155","CLSA-2026-1777941833","CLSA-2026-1787292931","CLSA-2026-1787374807","CLSA-2026-1788337769","CLSA-2026-1793619094","CLSA-2026-1794232618","EUVD-2025-21595","GHSA-4q2v-9p7v-3v22","ROOT-APP-MAVEN-CVE-2025-22227"],"status":"published","title":"CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client","description":"In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00405,"percentile":0.35133,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2025-07-16T09:31:15Z","modified":"2026-11-09T19:15:10Z","fixes":[{"ecosystem":"Maven","package":"io.projectreactor.netty:reactor-netty-http","fixed_in":["1.3.0-M5","1.2.8"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","fixed_in":["1.0.39-tuxcare.1","1.1.15-tuxcare.1","1.0.48-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.io.projectreactor.netty:reactor-netty-http","fixed_in":["1.0.45-root.io.1","1.0.45-root.io.2","1.0.45-root.io.3","1.1.13-root.io.1","1.1.13-root.io.2","1.1.22-root.io.1","1.1.13-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.projectreactor.netty:reactor-netty-http","fixed_in":["1.0.45-aikido.3","1.1.22-aikido.1","1.1.13-aikido.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-M1"},{"fixed":"1.3.0-M5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.8"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.39"},{"fixed":"1.0.39-tuxcare.1"}]}],"versions":["1.0.39"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.23"},{"fixed":"1.0.23-tuxcare.1"}]}],"versions":["1.0.23"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.23"},{"fixed":"1.0.23-tuxcare.1"}]}],"versions":["1.0.23"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15"},{"fixed":"1.1.15-tuxcare.1"}]}],"versions":["1.1.15"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.0-tuxcare.1"}]}],"versions":["1.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.1"}]}],"versions":["1.1.31"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.31"},{"fixed":"1.1.31-tuxcare.1"}]}],"versions":["1.1.31"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.48"},{"fixed":"1.0.48-tuxcare.3"}]}],"versions":["1.0.48","1.0.48-tuxcare.1","1.0.48-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.13"},{"fixed":"1.1.13-tuxcare.1"}]}],"versions":["1.1.13"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.13"},{"fixed":"1.1.13-tuxcare.1"}]}],"versions":["1.1.13"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.18"},{"fixed":"1.0.18-tuxcare.1"}]}],"versions":["1.0.18"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.18"},{"fixed":"1.0.18-tuxcare.1"}]}],"versions":["1.0.18"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.17"},{"fixed":"1.0.17-tuxcare.2"}]}],"versions":["1.0.17","1.0.17-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.17"},{"fixed":"1.0.17-tuxcare.2"}]}],"versions":["1.0.17","1.0.17-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-M1"},{"fixed":"1.3.0-M5"}]}],"versions":["1.3.0-M1","1.3.0-M2","1.3.0-M3","1.3.0-M4"]},{"source":"osv","ecosystem":"Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.8"}]}],"versions":["1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.25","1.0.26","1.0.27","1.0.28","1.0.29","1.0.3","1.0.30","1.0.31","1.0.32","1.0.33","1.0.34","1.0.35","1.0.36","1.0.37","1.0.38","1.0.39","1.0.4","1.0.40","1.0.41","1.0.42","1.0.43","1.0.44","1.0.45","1.0.46","1.0.47","1.0.48","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.10","1.1.11","1.1.12","1.1.13","1.1.14","1.1.15","1.1.16","1.1.17","1.1.18","1.1.19","1.1.2","1.1.20","1.1.21","1.1.22","1.1.23","1.1.24","1.1.25","1.1.26","1.1.27","1.1.28","1.1.29","1.1.3","1.1.30","1.1.31","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.45-root.io.1"},{"fixed":"1.0.45-root.io.2"},{"fixed":"1.0.45-root.io.3"},{"fixed":"1.1.13-root.io.1"},{"fixed":"1.1.13-root.io.2"},{"fixed":"1.1.22-root.io.1"},{"fixed":"1.1.13-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.projectreactor.netty:reactor-netty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.45-aikido.3"},{"fixed":"1.1.22-aikido.1"},{"fixed":"1.1.13-aikido.3"}]}]}],"products":[{"vendor":"vmware","product":"reactor netty"}],"references":[{"url":"https://spring.io/security/cve-2025-22227","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22227","tags":["advisory"]},{"url":"https://github.com/reactor/reactor-netty/commit/522892307ea89bf24fe634e8bfea35728c9bf411","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4q2v-9p7v-3v22"},{"url":"https://github.com/reactor/reactor-netty","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-22227","title":"CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client","description":"In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.","status":"published","published":"2025-07-16T09:31:15.293Z","modified":"2026-06-23T16:32:45.532Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:32:28.943062Z"}],"euvd":[{"id":"EUVD-2025-21595","description":"In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.","status":"published","published":"2025-07-16T09:31:15Z","modified":"2026-06-23T16:32:45Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:31.896888Z"}],"ghsa":[{"id":"GHSA-4q2v-9p7v-3v22","title":"Reactor Netty HTTP is vulnerable to credential leaks during chained redirects","description":"In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.","status":"published","published":"2025-07-16T12:30:21Z","modified":"2025-07-16T20:35:42Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:50.834587Z"}],"nvd":[{"id":"CVE-2025-22227","description":"In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.","status":"published","published":"2025-07-16T10:15:27.787Z","modified":"2026-06-17T08:45:45.027Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:11:18.782156Z"}],"osv":[{"id":"GHSA-4q2v-9p7v-3v22","title":"Reactor Netty HTTP is vulnerable to credential leaks during chained redirects","description":"In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.","status":"published","published":"2025-07-16T12:30:21Z","modified":"2026-09-10T03:50:25.758309542Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-22227","title":"CVE-2025-22227 in io.root.io.projectreactor.netty:reactor-netty-http - Patched by Root","description":"Root has patched CVE-2025-22227 in the io.root.io.projectreactor.netty:reactor-netty-http package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-08-02T18:27:46Z","modified":"2026-08-03T01:15:05.41869247Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"CLSA-2025-1763424415","title":"TuxCare security update for io.projectreactor.netty:reactor-netty-http (1 CVE)","description":"TuxCare rebuilt io.projectreactor.netty:reactor-netty-http to address 1 CVE. Fixed in 1.0.39-tuxcare.1.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-11-02T19:45:04.957615764Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1768435721","title":"TuxCare security update for io.projectreactor.netty (4 CVEs)","description":"TuxCare rebuilt 2 io.projectreactor.netty packages to address 4 CVEs. Fixed in 1.0.23-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:14.498412816Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1768781329","title":"TuxCare security update for io.projectreactor.netty:reactor-netty-http (1 CVE)","description":"TuxCare rebuilt io.projectreactor.netty:reactor-netty-http to address 1 CVE. Fixed in 1.1.15-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:12.290098927Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1775003155","title":"TuxCare security update for io.projectreactor.netty:reactor-netty-http (2 CVEs)","description":"TuxCare rebuilt io.projectreactor.netty:reactor-netty-http to address 2 CVEs. Fixed in 1.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:17Z","modified":"2026-11-02T19:45:20.266707012Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1777941833","title":"TuxCare security update for org.springframework.pulsar (2 CVEs)","description":"TuxCare rebuilt 6 org.springframework.pulsar packages to address 2 CVEs. Fixed in 1.1.13-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:30Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1787292931","title":"TuxCare security update for io.projectreactor.netty (2 CVEs)","description":"TuxCare rebuilt 2 io.projectreactor.netty packages to address 2 CVEs. Fixed in 1.1.31-tuxcare.1.","status":"published","published":"2026-08-21T06:15:31Z","modified":"2026-11-02T19:45:56.499091307Z","updated_at":"2026-11-02T20:29:50.522328Z"},{"id":"CLSA-2026-1787374807","title":"TuxCare security update for io.projectreactor.netty:reactor-netty-http (1 CVE)","description":"TuxCare rebuilt io.projectreactor.netty:reactor-netty-http to address 1 CVE. Fixed in 1.0.48-tuxcare.3.","status":"published","published":"2026-08-22T05:00:07Z","modified":"2026-11-02T19:45:59.512420726Z","updated_at":"2026-11-02T20:29:49.757752Z"},{"id":"CLSA-2026-1788337769","title":"TuxCare security update for io.projectreactor.netty (2 CVEs)","description":"TuxCare rebuilt 2 io.projectreactor.netty packages to address 2 CVEs. Fixed in 1.1.13-tuxcare.1.","status":"published","published":"2026-09-02T08:29:29Z","modified":"2026-11-02T19:46:05.084144223Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1793619094","title":"TuxCare security update for io.projectreactor.netty (4 CVEs)","description":"TuxCare rebuilt 2 io.projectreactor.netty packages to address 4 CVEs. Fixed in 1.0.18-tuxcare.1.","status":"published","published":"2026-11-02T12:31:35Z","modified":"2026-11-02T19:46:33.672226507Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1794232618","title":"TuxCare security update for io.projectreactor.netty (3 CVEs)","description":"TuxCare rebuilt 2 io.projectreactor.netty packages to address 3 CVEs. Fixed in 1.0.17-tuxcare.2.","status":"published","published":"2026-11-09T14:56:59Z","modified":"2026-11-09T19:15:10.35361026Z","updated_at":"2026-11-09T19:38:09.278998Z"}]}}