CVE-2026-41715
1 advisory.
Maven/io.projectreactor.netty:reactor-netty CVE-2026-41715: medium 6.1
Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect
Action: Upgrade io.projectreactor.netty:reactor-netty to 1.2.18 (1.2.x) or 1.3.6 (1.3.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.0 | 1.3.6 | - |
| 1.2.0 | 1.2.18 | - |
| 1.1.0 | - | 1.1.31 |
| 1.0.0 | - | 1.0.48 |
Fixed versions
| 1.3.6 | 1.2.18 |
Sources
- osv: GHSA-pfc9-2cqg-9wq6
- https://nvd.nist.gov/vuln/detail/CVE-2026-41715
- https://github.com/reactor/reactor-netty/commit/e7ef551eead84ba465324531683fafa03ab96ee9
- https://github.com/reactor/reactor-netty
- https://github.com/reactor/reactor-netty/releases/tag/v1.2.18
- https://github.com/reactor/reactor-netty/releases/tag/v1.3.6
- https://spring.io/security/cve-2026-41715
CVE-2026-41715 · published · modified · JSON