Medium severity · published Jun 9, 2026
CVE-2026-41715
Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Affected versions:
Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RN
Reactor Netty · Spring
1.0.0 before 1.0.52; 1.1.0 before 1.1.36; 1.2.0 before 1.2.17.1; 1.3.0 before 1.3.15.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41715
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41715
spring.io
https://spring.io/security/cve-2026-41715
More from Reactor Netty
6.1
CVE-2026-47848
Reactor Netty WebSocket Client Leaks Credentials On Redirect
5.3
CVE-2026-47874
Reactor Netty HTTP Server Denial of Service With Pipelined Requests
5.3
CVE-2026-47845
Reactor Netty HTTP Server may incorrectly evaluate proxy addresses
3.7
CVE-2026-47844
Reactor Netty HTTP Server Leaks Exception Details
3.7
CVE-2026-47843
Reactor Netty may incorrectly route traffic due to DNS resolver reuse