CVE-2025-22227

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

Score

CVSS 3.1 6.1 Medium

Status

Deferred - security@vmware.com

Published

2025-07-16

Last modified

2026-06-23

Weaknesses

CWE-200

Affected products

• Reactor Netty (Vmware)

References

• https://spring.io/security/cve-2025-22227