Reactor Netty HTTP Client Credential Leak Vulnerability on Protocol Downgrade Redirect

A vulnerability exists in the Reactor Netty HTTP client, versions 1.0.0 prior to 1.0.51, 1.1.0 prior to 1.1.35, 1.2.0 prior to 1.2.17, and 1.3.0 prior to 1.3.5. In certain scenarios where HTTP redirects occur from a secure to an insecure endpoint, the client may unintentionally expose credentials. This issue arises only if the HTTP client is explicitly set to follow redirects.

Impact

Exploitation of this vulnerability could lead to the unintentional leakage of credentials during HTTP redirects from secure to insecure endpoints.

Remediation

Users should upgrade to Reactor Netty version 1.0.52, 1.1.36, 1.2.18, or 1.3.6, depending on their current version. Instructions for upgrading are available on the Spring Enterprise Support site.