{"action":"Upgrade io.projectreactor.netty:reactor-netty to 1.2.18 (1.2.x) or 1.3.6 (1.3.x) or later.","affected":[{"fixed":"1.3.6","introduced":"1.3.0"},{"fixed":"1.2.18","introduced":"1.2.0"},{"introduced":"1.1.0","last_affected":"1.1.31"},{"introduced":"1.0.0","last_affected":"1.0.48"}],"component":"io.projectreactor.netty:reactor-netty","cve_ids":["CVE-2026-41715"],"ecosystem":"Maven","epss":0.00175,"exploited":false,"fixed_versions":["1.3.6","1.2.18"],"ghsa_id":"GHSA-pfc9-2cqg-9wq6","id":"tcs_01M5N979WW4KB9F34Q1GRHCE6T","modified_at":"2026-07-29T18:41:44.732177Z","published_at":"2026-06-09T06:31:57Z","references":["https://osv.dev/vulnerability/GHSA-pfc9-2cqg-9wq6","https://nvd.nist.gov/vuln/detail/CVE-2026-41715","https://github.com/reactor/reactor-netty/commit/e7ef551eead84ba465324531683fafa03ab96ee9","https://github.com/reactor/reactor-netty","https://github.com/reactor/reactor-netty/releases/tag/v1.2.18","https://github.com/reactor/reactor-netty/releases/tag/v1.3.6","https://spring.io/security/cve-2026-41715"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-pfc9-2cqg-9wq6","url":"https://osv.dev/vulnerability/GHSA-pfc9-2cqg-9wq6"}],"summary":"Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect"}