CVE-2025-22227

CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client

Medium · published July 16, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00405 · 33.7th percentile
Published
2025-07-16T09:31Z
EPSS history
Timeline
  • 16 JUL 09:31Z
    CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client
    cvelistv5