CVE-2026-41715: Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41715?
CVE-2026-41715 has a medium severity rating of 6.1.
How do I fix CVE-2026-41715?
To fix CVE-2026-41715, update the Reactor Netty HTTP client to version 1.0.52 or later.
What causes the credential leak in CVE-2026-41715?
The credential leak in CVE-2026-41715 occurs when the Reactor Netty HTTP client is configured to follow redirects from a secure to an insecure endpoint.
Which versions of Reactor Netty are affected by CVE-2026-41715?
Reactor Netty versions 1.0.0 through 1.0.51 and 1.1.x are affected by CVE-2026-41715.
Can I use Reactor Netty HTTP client safely if I don't follow redirects?
Yes, if you do not configure the Reactor Netty HTTP client to follow redirects, the risk associated with CVE-2026-41715 is mitigated.