CVE-2026-41715CWE-522

Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect

Medium · published June 9, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

Affected versions:

Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00240 · 14.2th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-06-09T03:48Z
EPSS history
Timeline
  • 09 JUN 03:48Z
    Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect
    cvelistv5