CVE-2025-22227
CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
| Vendor | vmware |
| Product | reactor netty |
| Ecosystems | |
| Industries | TechnologyEnterprise |
| Published | Jul 16, 2025 |
| Last Updated | Jun 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for vmware reactor netty
Be the first to know when new medium vulnerabilities affecting vmware reactor netty are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
VMware / Reactor Netty
1.0.x < 1.0.49 (Reactor BOM 2020.0.48) 1.1.x < 1.1.32 (Reactor BOM 2022.0.27 and 2023.0.20) 1.2.x < 1.2.8 (Reactor BOM 2024.0.8) 1.3.x < 1.3.0-M5 (Reactor BOM 2025.0.0-M5)