Threats affecting pkg:maven/io.projectreactor/reactor-netty

CVE-2026-41715 is a medium severity vulnerability in Spring Reactor Netty HTTP client where credentials may be leaked during HTTP redirects from secure to insecure endpoints if the client is configured to follow redirects. This affects versions 1.0.0 through 1.0.51, 1.1.0 through 1.1.35, 1.2.0 through 1.2.17, and 1.3.0 through 1.3.5. No official patch or remediation guidance is currently available.

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.