---
id: CVE-2020-5404
title: >-
  The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions
  0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak
  during a redirect to a different domain
summary: >-
  The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions
  0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak
  during a redirect to a different domain. In order for this to happen, the
  HttpCl…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-522
  - CWE-522
vendor: broadcom
product: reactor_netty
affected:
  - 'reactor_netty >= 0.8.0, <= 0.8.15'
  - 'reactor_netty >= 0.9.0, <= 0.9.4'
published: '2020-03-03'
updated: '2026-09-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-5404'
references:
  - url: 'https://pivotal.io/security/cve-2020-5404'
    label: security@pivotal.io
  - url: 'https://pivotal.io/security/cve-2020-5404'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00653
epssPercentile: 0.49513
ingestedAt: '2026-09-04T19:26:35.254Z'
---

## Overview

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.

## Affected

- `reactor_netty >= 0.8.0, <= 0.8.15`
- `reactor_netty >= 0.9.0, <= 0.9.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.