6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-22227

CVE-2025-22227: Reactor Netty HTTP is vulnerable to credential leaks during chained redirects

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-22227

CVE-2025-22227:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.projectreactor.netty:reactor-netty-http	maven	>= 1.3.0-M1, < 1.3.0-M5	1.3.0-M5
io.projectreactor.netty:reactor-netty-http	maven	< 1.2.8	1.2.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-22227, causes Reactor Netty's HTTP client to leak credentials during chained redirects. This occurs under specific conditions: the client must be configured to follow redirects, and an HTTP/1.1 connection must be upgraded to HTTP/2 during the redirect process.

The root cause lies in the incorrect state management of the connection when a new HTTP/2 stream is created after the protocol upgrade. The state of the original HTTP/1.1 connection, specifically whether headers and body have already been sent, was not being transferred to the new HTTP/2 stream operations.

When a redirect happens, the HttpClient prepares a new request. Due to the missing state, the HttpClientOperations for the new request would incorrectly believe that no headers have been sent yet. This could cause it to re-apply headers from the original request, including sensitive Authorization headers, to the redirected request, even if the redirect target is a different, potentially untrusted, origin.

The patch addresses this by introducing state-copying logic.

A new static method, HttpClientOperations.copyState, is added to transfer the hasSentHeaders and hasSentBody status from a parent HttpClientOperations to a new one.
The HttpClientConfig.addStreamHandlers method is modified to accept a copyState boolean flag. When true, it invokes HttpClientOperations.copyState.
The HttpClientConfig.Http2ChannelInitializer.initChannel method, which is called during the HTTP/1.1 to HTTP/2 upgrade, is updated to call addStreamHandlers with copyState=true, ensuring the state is correctly propagated to the new HTTP/2 stream.

Therefore, the vulnerable functions are HttpClientConfig.addStreamHandlers and HttpClientConfig$Http2ChannelInitializer.initChannel because, in their pre-patch versions, they were responsible for creating the new stream in a state that could lead to the credential leak. An engineer with this CVE in their environment should understand that any HTTP client usage with automatic redirect following enabled is at risk, especially if the services it communicates with might issue redirects after an HTTP/2 upgrade. The fix ensures that the client correctly tracks the request state across such protocol transitions, preventing the accidental leakage of credentials.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.