Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-41715Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect
Medium 6.1
In plain English
A medium-severity security flaw in Reactor Netty from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.projectreactor.netty:reactor-netty | 1.3.6 | GHSA-pfc9-2cqg-9wq6 |
| Maven | io.projectreactor.netty:reactor-netty | 1.2.18 | GHSA-pfc9-2cqg-9wq6 |
| Maven | io.projectreactor.netty:reactor-netty | no fix listed | GHSA-pfc9-2cqg-9wq6 |
| Maven | io.projectreactor.netty:reactor-netty | no fix listed | GHSA-pfc9-2cqg-9wq6 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Reactor Netty | 1.0.0 – before 1.0.521.1.0 – before 1.1.361.2.0 – before 1.2.17.11.3.0 – before 1.3.15.1 |
Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N