The vulnerability CVE-2026-41715 (CWE-522) in Spring Reactor Netty HTTP client occurs when the client follows HTTP redirects from HTTPS to HTTP endpoints, potentially leaking credentials. This issue arises only if the client is explicitly configured to follow redirects. Affected versions include Reactor Netty 1.0.0 through 1.0.51, 1.1.0 through 1.1.35, 1.2.0 through 1.2.17, and 1.3.0 through 1.3.5. The CVSS 3.1 base score is 6.1, indicating medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker could potentially obtain credentials leaked by the Reactor Netty HTTP client when it follows redirects from a secure HTTPS endpoint to an insecure HTTP endpoint. This could lead to partial confidentiality and integrity loss of sensitive information transmitted during such redirects. The vulnerability requires user interaction and explicit client configuration to follow redirects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid configuring the Reactor Netty HTTP client to follow redirects from secure to insecure endpoints. Review application configurations to prevent automatic redirect following in these scenarios.