The vulnerability centers on improper header propagation during redirects. Analysis focuses on Reactor Netty's HTTP client redirect handling mechanism:

1. HttpClientFinalizer.followRedirect is the primary redirect coordinator, making it the logical location for header management decisions
2. RedirectClientHandler.send would execute the actual redirected request construction While exact patch details are unavailable, the vulnerability description explicitly identifies header propagation during redirects as the flaw. These functions represent the core redirect implementation where credential-containing headers would be inappropriately forwarded prior to the 0.8.11 fix that likely added host validation and header filtering.