CVE-2025-22227
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Reactor Netty
- Vendor
- VMware
- Product
- Reactor Netty
- Platforms
- Unknown
- Default status
unaffected- Package
- Reactor Netty
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1.0.x | affected | commercial | 1.0.49 (Reactor BOM 2020.0.48) | Unavailable | None listed |
| 1.1.x | affected | commercial | 1.1.32 (Reactor BOM 2022.0.27 and 2023.0.20) | Unavailable | None listed |
| 1.2.x | affected | OSS | 1.2.8 (Reactor BOM 2024.0.8) | Unavailable | None listed |
| 1.3.x | affected | OSS | 1.3.0-M5 (Reactor BOM 2025.0.0-M5) | Unavailable | None listed |