In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak stored credentials when configured to follow redirects. This constitutes a confidentiality breach, as compromised credentials could enable unauthorized authentication to protected services. The weakness arises from improper handling of redirect chains, consistent with CWE-319 and CWE-522.

The affected products are Spring’s Reactor Netty library. Vulnerable versions include 1.0.0 through 1.0.51, 1.1.0 through 1.1.35, 1.2.0 through 1.2.17, and 1.3.0 through 1.3.5. Organizations using any of these releases need to evaluate whether their applications permit automatic redirect following over HTTPS to HTTP redirects.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of 0.00172 (<1%) indicates a low exploitation probability, and the vulnerability is not yetISA KEV catalog. Exploitation requires an attacker to manipulate a client that follows redirects from a secure origin to an insecure one, typically by controlling the redirect target or by forging a malicious redirect response,. The risk therefore depends on the application’s redirect policies and network context, but the low exploitation probability suggests that attackers would need directed access to the redirect flow.