Information disclosure in Reactor Netty - CVE-2026-41715
Published: August 28, 2026
Vulnerability identifier: #VU146286
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41715
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose credentials.
The vulnerability exists due to improper handling of credential forwarding in the Reactor Netty HTTP client redirect handling when following redirects from a secure endpoint to an insecure endpoint. A remote attacker can trigger a protocol downgrade redirect to disclose credentials.
The HTTP client must be explicitly configured to follow redirects, and user interaction is required.
Affected software
Reactor Netty
IBM Sterling File Gateway
IBM Sterling B2B Integrator
webMethods developer portal
webMethods ControlPlane
IBM Sterling File Gateway
IBM Sterling B2B Integrator
webMethods developer portal
webMethods ControlPlane
How to mitigate CVE-2026-41715
Install security update from vendor's website.
Reactor Netty - addressed in versions 1.0.52, 1.1.36, 1.2.18, 1.3.6
IBM Sterling File Gateway - addressed in versions 6.2.1.2.1, 6.2.2.1.1
IBM Sterling B2B Integrator - addressed in versions 6.2.1.2.1, 6.2.2.1.1
webMethods developer portal - update to 11.1 Fix13
webMethods ControlPlane - update to 11.1 Fix11
IBM Sterling File Gateway - addressed in versions 6.2.1.2.1, 6.2.2.1.1
IBM Sterling B2B Integrator - addressed in versions 6.2.1.2.1, 6.2.2.1.1
webMethods developer portal - update to 11.1 Fix13
webMethods ControlPlane - update to 11.1 Fix11