Executive brief
Reactor Netty is a networking library used by Java applications to handle web traffic. A security issue exists where the library may accidentally send sensitive login credentials to an insecure (unencrypted) website if it is automatically redirected from a secure one. This could allow an attacker to intercept and steal user credentials or authentication tokens.
Technical details
A credential leak vulnerability (CWE-522) exists in the Reactor Netty HTTP client during protocol downgrade redirects. When the client is explicitly configured to follow redirects, it may fail to strip sensitive authentication headers when transitioning from an HTTPS endpoint to an HTTP endpoint. An attacker who can trigger or influence such a redirect could capture these credentials in plaintext over the network. The issue is rooted in the header handling logic within HttpClientConnect.java. Patches are available in versions 1.2.18 and 1.3.6.
Affected products
- Spring Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory