CVE-2025-22227
BaseFortify
Publication date: 2025-07-16
Last updated on: 2025-07-16
Assigner: VMware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| reactor_netty | http_client | * |
| reactor_netty | http_client | 1.0 |
| reactor_netty | http_client | 1.3 |
| reactor_netty | http_client | 1.1 |
| reactor_netty | http_client | 1.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Reactor Netty HTTP client when it is explicitly configured to follow redirects. In certain scenarios involving chained redirects, the client can leak credentials, potentially exposing sensitive information.
How can this vulnerability impact me? :
The vulnerability can lead to leakage of credentials during HTTP requests involving chained redirects, which may result in unauthorized access or exposure of sensitive information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid configuring the Reactor Netty HTTP client to follow redirects, especially in scenarios where chained redirects may occur. Review and update your HTTP client configuration to disable automatic redirect following until a patch or fix is available.