Reactor Netty EUVD-2026-35322

Two explicit, non-default conditions must both be present for exploitation. First, the Reactor Netty HTTP client must be explicitly configured to follow redirects - this is a deliberate opt-in setting (e.g., via HttpClient.followRedirect(true) or equivalent), not the library default. Second, a redirect from a secure HTTPS endpoint to an insecure HTTP endpoint must occur, meaning the attacker must be able to influence or control the HTTP response (e.g., operate the target server, compromise it, or perform a network-level interception). The CVSS UI:R metric further indicates that a user or application action must initiate the outbound HTTP request that triggers the redirect chain. Exploitation is limited by: (1) the non-default redirect-following configuration requirement, (2) the need for attacker influence over redirect responses, and (3) user interaction to trigger the request. Deployments where all outbound HTTPS targets are fully trusted and cannot issue cross-protocol redirects are not exploitable.

The CVSS 6.1 Medium score reflects a nuanced risk profile: AV:N (network reachable), AC:L (low complexity once conditions are met), PR:N (no attacker credentials required), UI:R (user interaction required - a request must be triggered), S:C (changed scope; the impact extends beyond the Reactor Netty component itself to any downstream system relying on the leaked credentials), and C:L/I:L (limited but real confidentiality and integrity impact). The UI:R metric is the primary limiting factor: exploitation depends on an action that causes the HTTP client to issue a request toward a server the attacker influences. No EPSS score was supplied, and this CVE is absent from the CISA KEV catalog, indicating no confirmed widespread or opportunistic exploitation. No public proof-of-concept has been identified at time of analysis. The net real-world risk is moderate: organizations running applications where Reactor Netty is configured with redirect-following AND where outbound requests may target attacker-influenced servers (e.g., third-party APIs, user-supplied URLs) face a meaningful credential theft risk. Internal-only service meshes with controlled server lists are at lower practical risk.

An attacker who controls an HTTPS server endpoint - or can inject a malicious redirect response via a man-in-the-middle position - responds to an authenticated request from a Reactor Netty client with an HTTP 301/302 redirect pointing to a plaintext HTTP URL under the attacker's control. Because the client is configured to follow redirects, it re-issues the request to the HTTP endpoint, forwarding the original Authorization header or equivalent credentials in cleartext. The attacker captures these credentials and may reuse them to impersonate the client against the original service. No public proof-of-concept is known at time of analysis, but the attack mechanism is straightforward and well-understood.