The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.

Affected: Maven: io.projectreactor.netty:reactor-netty-http

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.

reactor-netty: specific redirect configuration allows for a credentials leak kubernetes-client: Insecure deserialization in unmarshalYaml method protobuf-java: potential DoS in the parsing procedure for binary data undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629) undertow: Double AJP response for 400 from EAP 7 results in CPING failures spring-expression: Denial of service via specially crafted SpEL expression