Reactor Netty HTTP Client Authentication Leak Vulnerability

A vulnerability exists in the Reactor Netty HTTP client, versions 1.0.0 through 1.0.48, 1.1.0 through 1.1.31, 1.2.0 through 1.2.7, and 1.3.0-M1 through 1.3.0-M4, where credentials can be leaked during chained redirects. This issue arises only if the HTTP client is configured to follow redirects.

Impact

Exploitation of this vulnerability results in an unintentional leak of authentication credentials.

Remediation

Users should upgrade to Reactor Netty versions 1.2.8 or 1.3.0-M5, or to the corresponding fixed versions in the 1.0.x or 1.1.x branches. Instructions for obtaining these versions are available on the Spring website.