CVE-2025-22227 CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client
Attackers can steal credentials when the Reactor Netty HTTP client follows chained redirects, requiring explicit redirect configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-22227?
CVE-2025-22227 is a medium-severity vulnerability in VMware Reactor Netty, published on 16 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Weakness: CWE-200
Which versions are affected by CVE-2025-22227?
4 open source packages ship an affected version, including io.projectreactor.netty:reactor-netty-http.
| Package | Affected | Fixed in |
|---|---|---|
io.projectreactor.netty:reactor-netty-http Maven | All versions | 1.2.8 |
io.projectreactor.netty:reactor-netty-http Maven | All versions | 1.2.8 |
io.projectreactor.netty:reactor-netty-http Maven | From 1.3.0-M1 | 1.3.0-M5 |
io.projectreactor.netty:reactor-netty-http Maven | From 1.3.0-M1 | 1.3.0-M5 |
How do I fix CVE-2025-22227?
Upgrade io.projectreactor.netty:reactor-netty-http to a fixed version for your release line: 1.2.8 or 1.3.0-M5.
Is CVE-2025-22227 being exploited?
There is no known exploitation of CVE-2025-22227 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-CQ96086, CLEANSTART-2026-NJ85552, CLEANSTART-2026-QV47871, CLEANSTART-2026-SF24909, CLSA-2025-1763424415, CLSA-2026-1768781329 and 29 more.