CLEANSTART-2026-TZ01622 In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials

🗓️ 30 Oct 2026 10:00:10Reported by GoogleType

osv_cleanstart🔗 osv.dev👁 7 Views

Reactor Netty HTTP client may leak credentials during secure to insecure HTTP redirects.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	6 Aug 202607:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Netty Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway	15 Sep 202615:28	–	ibm
IBM Security Bulletins	Security Bulletin: Vilunarabilities found in reactor-netty-http-1.2.13.jar in APIM	15 Sep 202607:47	–	ibm
CNNVD	Spring Reactor Netty Trust Management Vulnerability	9 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41715	9 Jun 202603:48	–	cve
Cvelist	CVE-2026-41715 Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect	9 Jun 202603:48	–	cvelist
EUVD	EUVD-2026-35322	9 Jun 202603:48	–	euvd
F5 Networks	K000162299: Reactor Netty vulnerability CVE-2026-41715	16 Jul 202615:34	–	f5
Github Security Blog	Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect	9 Jun 202606:31	–	github
Mend	CVE-2026-41715	9 Jun 202603:48	–	mend

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TZ01622.json
osv	www.osv.dev/vulnerability/CVE-2026-41715
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41715

31 Oct 2026 01:02Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.16.1

EPSS0.00175

Reactor Netty HTTP client credential leak HTTP redirect