CVE-2020-5404 Authentication Leak On Redirect With Reactor Netty HttpClient

What is CVE-2020-5404?

CVE-2020-5404 is a medium-severity vulnerability in Pivotal Reactor Netty, published on 3 Mar 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.

Weakness: CWE-522

Which versions are affected by CVE-2020-5404?

4 open source packages ship an affected version, including io.projectreactor.netty:reactor-netty-http. It affects 1 product.

Products include Broadcom Reactor Netty.

How do I fix CVE-2020-5404?

Upgrade io.projectreactor.netty:reactor-netty-http to a fixed version for your release line: 0.8.16 or 0.9.5.

Is CVE-2020-5404 being exploited?

There is no known exploitation of CVE-2020-5404 in the wild and no public exploit code.

Other vulnerabilities in Pivotal Reactor Netty

• CVE-2023-34062 In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack High 7.5
• CVE-2019-11284 Reactor Netty authentication leak in redirects Medium 6.8
• CVE-2020-5403 DoS Via Malformed URL with Reactor Netty HTTP Server Medium 6.5
• CVE-2026-47848 Reactor Netty WebSocket Client Leaks Credentials On Redirect Medium 6.1
• CVE-2026-47844 Reactor Netty HTTP Server Leaks Exception Details Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gpch-h32j-gx6x.