What’s Vulnerable › Vulnerabilities
CVE-2025-22227: CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-07-16 · updated 2026-06-17
- Weakness: CWE-200
Description
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Affected products
- VMware Reactor Netty: from 1.0.x before 1.0.49 (Reactor BOM 2020.0.48); from 1.1.x before 1.1.32 (Reactor BOM 2022.0.27 and 2023.0.20); from 1.2.x before 1.2.8 (Reactor BOM 2024.0.8); from 1.3.x before 1.3.0-M5 (Reactor BOM 2025.0.0-M5) — fixed in 1.0.49 (Reactor BOM 2020.0.48), 1.1.32 (Reactor BOM 2022.0.27 and 2023.0.20), 1.2.8 (Reactor BOM 2024.0.8), 1.3.0-M5 (Reactor BOM 2025.0.0-M5)
How to fix
Upgrade to a fixed version: VMware Reactor Netty 1.0.49 (Reactor BOM 2020.0.48), 1.1.32 (Reactor BOM 2022.0.27 and 2023.0.20), 1.2.8 (Reactor BOM 2024.0.8), 1.3.0-M5 (Reactor BOM 2025.0.0-M5). Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-22227 or the next vulnerability affects your stack