VulnerabilityDeferred

CVE-2025-22227

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials.

MEDIUM 6.1EPSS 0.36%

Does this matter?

Lower severity and a low EPSS score (0.36%). Track it; it rarely justifies an emergency change on its own.

Description

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.36% probability · 29th percentile
CISA KEV: Not listed
Weakness: CWE-200
Source: security@vmware.com

References

https://spring.io/security/cve-2025-22227

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.