CVE-2025-22227: 
Java vulnerability analysis and mitigation

In July 2025, a vulnerability (CVE-2025-22227) was discovered in the Reactor Netty HTTP client that could potentially leak credentials during specific scenarios involving chained redirects. The vulnerability specifically affects situations where the HTTP client has been explicitly configured to follow redirects (Spring Security, NVD).

The vulnerability has been classified with a CVSS v3.1 Base Score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. It is categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

The vulnerability affects multiple versions of Reactor Netty, including versions 1.0.0-1.0.48, 1.1.0-1.1.31, 1.2.0-1.2.7, and 1.3.0-M1 through 1.3.0-M4. Older, unsupported versions are also affected by this security issue (Spring Security).

Users are advised to upgrade to the fixed versions: 1.0.49 (Reactor BOM 2020.0.48), 1.1.32 (Reactor BOM 2022.0.27 and 2023.0.20), 1.2.8 (Reactor BOM 2024.0.8), or 1.3.0-M5 (Reactor BOM 2025.0.0-M5). No additional mitigation steps are necessary after upgrading (Spring Security).

The vulnerability was responsibly reported by Martin van Wingerden, demonstrating effective coordination between security researchers and the Spring security team (Spring Security).