Reactor Netty Credential Leak on Protocol Downgrade Redirects — CVE-2026-41715

Overview

Reactor Netty is the reactive networking layer of Project Reactor: it wraps Netty in a Reactive Streams API and supplies the non-blocking HTTP client and server that Spring WebFlux runs on. The reactor-netty-http module carries that HTTP client, including the client's optional automatic following of HTTP redirect responses.

An Information Exposure vulnerability (CVE-2026-41715) has been identified in the redirect handling of the Reactor Netty HTTP client, which allows attackers to obtain credentials that were intended only for a TLS protected connection by observing them in cleartext.

Per OWASP: "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."

This issue affects the HTTP client redirect handling of Reactor Netty, and only when the client has been explicitly configured to follow redirects.

Details

Module Info

• Product: Reactor Netty
• Affected packages: io.projectreactor.netty:reactor-netty-http
• Affected versions: <1.2.18, >=1.3.0 <1.3.6
• GitHub repository: https://github.com/reactor/reactor-netty
• Published packages: https://central.sonatype.com/artifact/io.projectreactor.netty/reactor-netty-http
• Package manager: Maven
• Fixed in:
  • NES for Reactor Netty 1.0.48-reactor-netty-1.0.50
  • OSS Reactor Netty 1.2.18, 1.3.6

Vulnerability Info

This High-severity vulnerability is found in the io.projectreactor.netty:reactor-netty-http package in the HTTP client redirect handling of Reactor Netty.

When the client follows a redirect, HttpClientHandler decides whether to strip the sensitive EXPECT, COOKIE, AUTHORIZATION and PROXY_AUTHORIZATION headers by comparing the redirect target with the hop it is leaving:

Consumer<HttpClientRequest> consumer = null;
if (fromURI != null && !toURI.equals(fromURI)) {
    if (handler instanceof RedirectSendHandler) {
        headers.remove(HttpHeaderNames.EXPECT)
                .remove(HttpHeaderNames.COOKIE)
                .remove(HttpHeaderNames.AUTHORIZATION)
                .remove(HttpHeaderNames.PROXY_AUTHORIZATION);
    }
    else {
        consumer = request ->
                request.requestHeaders()
                        .remove(HttpHeaderNames.EXPECT)
                        .remove(HttpHeaderNames.COOKIE)
                        .remove(HttpHeaderNames.AUTHORIZATION)
                        .remove(HttpHeaderNames.PROXY_AUTHORIZATION);
    }
}

That comparison never looks at the scheme. UriEndpoint.equals considers only the resolved remote address, so two endpoints that share a host and port are equal whether they are reached over https or over plain http:

public boolean equals(Object o) {
    if (this == o) {
        return true;
    }
    if (o == null || getClass() != o.getClass()) {
        return false;
    }
    UriEndpoint that = (UriEndpoint) o;
    return getRemoteAddress().equals(that.getRemoteAddress());
}

A redirect that keeps the same host and port while downgrading https to http therefore compares equal, the guard does not fire, and the credentials are written to the downgraded request and transmitted without encryption to any observer on the network path. The matching port is what makes the exposure reachable: on default ports the downgrade also moves 443 to 80, the resolved addresses differ, and the guard already strips the headers.

The same block is also unreachable on the websocket handshake path, because the client returns to the caller for websocket setup before the stripping decision is made:

ch.listener().onStateChange(ch, HttpClientState.REQUEST_PREPARED);
if (websocketClientSpec != null) {
    Mono<Void> result =
            Mono.fromRunnable(() -> ch.withWebsocketSupport(websocketClientSpec, compress));
    if (handler != null) {
        result = result.thenEmpty(Mono.fromRunnable(() -> Flux.concat(handler.apply(ch, ch))));
    }
    return result;
}

Consumer<HttpClientRequest> consumer = null;

This vulnerability was introduced in 2019 with Reactor Netty 0.8.11.RELEASE.

Mitigation

The affected 1.0.x release line is End-of-Life and will not receive community updates addressing this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade Reactor Netty to a currently supported release containing the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Yu Bao (PayPal) (finder)