The DefaultRedirectHandler in Eclipse Vert.x propagates all request headers, except Content-Length, across HTTP 30x redirects without checking the target’s origin. This flaw causes credential headers such as Authorization, Cookie, Proxy-Authorization and custom tokens to be forwarded to an attacker-controlled host, exposing bearer tokens, basic-auth credentials, session cookies and API keys and leading to information disclosure (CWE‑200).

Eclipse Vert.x versions 4.5.29 and earlier and 5.1.4 and earlier in the 5.x branch are vulnerable. Deployments that use Vert.x’s HttpClient to follow redirects—such as webhook dispatchers, image proxies or microservice URL fetchers—are affected.

The CVSS score of 8.2 indicates high severity, while the EPSS score of < 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker can induce a Vert.x HttpClient to issue a request that is redirected to an attacker-controlled host; the default redirect processing will then forward every request header to that host, allowing the attacker to capture any credential data present in the original request without requiring additional privileges.