CVE-2025-22227

6.1 mediumEPSS 0.4%

Medium (6.1). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in io.projectreactor.netty:reactor-netty-http 1.2.8, 1.3.0-M5.

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2025-07-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-4q2v-9p7v-3v22	Maven	io.projectreactor.netty:reactor-netty-http	>=1.3.0-M1 <1.3.0-M5	1.3.0-M5
GHSA-4q2v-9p7v-3v22	Maven	io.projectreactor.netty:reactor-netty-http	<1.2.8	1.2.8

References

https://spring.io/security/cve-2025-22227

Check your stack JSON