CVE-2025-22227

🗓️ 16 Jul 2025 09:31:15Reported by vmwareType

Authentication leak with Reactor Netty HTTP client on specific chained redirects revealed.

Reporter	Title	Published	Views	Family All 63
IBM Security Bulletins	Security Bulletin:Vulnerability in reactor-netty-http affects IBM Netezza Appliance	16 Dec 202505:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager	16 Dec 202507:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability has addressed Multiple Vulnerabilities within Instana Agent container image	16 Sep 202509:57	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in reactor-netty-http-1.2.1.jar (used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2025-22227)	10 Nov 202507:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.0.3	7 Oct 202516:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager	16 Dec 202505:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data	16 Dec 202511:07	–	ibm
IBM Security Bulletins	Security Bulletin: Document Service Container of IBM Sterling B2B Integrator and IBM Sterling File Gateway is Vulnerable to Information Disclosure (CVE-2025-22227)	21 Nov 202512:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (April 2026 - Part 1 of 2)	1 May 202605:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM StreamSets Data Collector	10 Nov 202510:23	–	ibm

[
  {
    "defaultStatus": "unaffected",
    "packageName": "Reactor Netty",
    "product": "Reactor Netty",
    "vendor": "VMware",
    "versions": [
      {
        "lessThan": "1.0.49 (Reactor BOM 2020.0.48)",
        "status": "affected",
        "version": "1.0.x",
        "versionType": "commercial"
      },
      {
        "lessThan": "1.1.32 (Reactor BOM 2022.0.27 and 2023.0.20)",
        "status": "affected",
        "version": "1.1.x",
        "versionType": "commercial"
      },
      {
        "lessThan": "1.2.8 (Reactor BOM 2024.0.8)",
        "status": "affected",
        "version": "1.2.x",
        "versionType": "OSS"
      },
      {
        "lessThan": "1.3.0-M5 (Reactor BOM 2025.0.0-M5)",
        "status": "affected",
        "version": "1.3.x",
        "versionType": "OSS"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2025-22227

15 Apr 2026 00:35Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.16.1

EPSS0.0011

CWE-200