CVE-2026-41715

MediumCVSS 6.1/10Last modified Jul 23, 2026

Description

In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

Affected versions: Reactor Netty 1.0.0 through 1.0.51; 1.1.0 through 1.1.35; 1.2.0 through 1.2.17; 1.3.0 through 1.3.5.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-522

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 9, 2026
Last modified
Jul 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-417167.5Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustiCVE-2026-417178.1Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter bindiCVE-2026-417196.4A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query methodCVE-2026-41727.2A vulnerability was detected in TRENDnet TEW-632BRP 1.010B32. This affects an unknown part of the file /ping_response.cgi of the component HCVE-2026-417207.4Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empCVE-2026-417215.9Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in cCVE-2026-417225.4VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to createCVE-2026-417238.0VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to createCVE-2026-417245.4VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to createCVE-2026-417266.5When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique rCVE-2026-417276.5Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer coulCVE-2026-417287.5Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segme